Session ID can also contain , and - characters which ctype_alnum() does not use