PHP客户端可以设置$ _SESSION变量吗？

Question

Is there any scenario where a client/user/hacker can set $_SESSION variables themselves (excluding malicious software running on a server computer. I mostly mean via the browser)?

The reason I ask is because of this question that I asked a few days ago. Since then I have become pretty confused on the subject, but I've got a better idea of session fixation and hijacking.

To put it as simply as possible, if I validate every page with something like isset($_SESSION['validated']), is it secure?

Answer 1

Yes if you were assigning $_SESSION variables directly to unfiltered user input.

Which brings me to my point: NEVER TRUST INPUT FROM THE USER. EVER

If indeed you are filtering the input, then I don't see how it could be done.