session.auto_start or session_start()

whats the difference between auto sessions and manual

[HeadBut]

I'd like to keep security in mind with my application, should I use auto_start configuration or is it better to handle sessions myself. I'd also like to know how to tell how many people are in the application at any given time.

Many Thanks

[ReveL]

If you do turn on session.auto_start then you cannot put objects into your sessions since the class definition has to be loaded before starting the session in order to recreate the objects in your session.