As I understand it a session is stored on the server side only. User id (or session id) for the session is stored in a cookie or url. So, a user, even if he or she is a super hacker, cannot locally change any $_SESSION variables that I use on my site except the session id or the user id?

php session
Edit
Report