How Secure Are Session Variables?

[smerny]

If I have a session variable "user_rank" and have a number assigned to it which determines whether or not the user has access to certain features.... is that secure? or should I be cross-checking the database every time a user does something that requires a high rank?

[justsomeguy]

I'm not aware of any ways to change session values on the server, as long as your script doesn't give someone a way to do that.

[Ingolme]

If I have a session variable "user_rank" and have a number assigned to it which determines whether or not the user has access to certain features.... is that secure? or should I be cross-checking the database every time a user does something that requires a high rank?

I'd have their rank in the database. When the user enters a page, the session variable only needs to tell the PHP script that the user is logged in.EDIT: Actually, none of the session information except the ID is ever sent to the client, so the information of a session variable is pretty safe.