PHP: can session variables be injected client-side?

J

josh.rofl

New member
Let's say I have an authentication script. I use $_SESSION['admin'] to store true or false - will use this later to determine if the user has admin access on the website.

Are session variables like COOKIES, that the client can alter them? Or can session variables only be set by the server?
 
Back
Top