Can a hacker set a PHP session variable?
<p>Part of the security check I set up is the random generation of an integer as a security token stored as a <code>$_SESSION</code> variable. This is validated through specific scripts and sets a boolean to true or false depending on if it's been validated (allowing entry to the site if other checks are passed). Is it possible for a hacker to somehow set this session variable? If so, how?</p>