title: Is php session unchangeable from user end?
body: <p>I am developing my own application which requires user login. All users and passwords (encrypted) are stored in a database. When a user tries to login, then it search in the database the username and password. If all is ok, then I store <code>username</code> in <code>$_SESSION["username"]</code>, user <code>role</code> (admin, author etc) in <code>$_SESSION["role"]</code> and user <code>website</code> in <code>$_SESSION["website"]</code> (I need website to be stored because the application is like "multisite" - my applicaton is hosted on client hosting but the administration is on my server).</p>
  
  <p>I read this <a href="https://stackoverflow.com/questions/5121766/can-a-user-alter-the-value-of-session-in-php">Can a user alter the value of $_SESSION in PHP?</a> and I don't understand. Is this method secure (of storing data and if user is logged in) in a <code>$_SESSION</code>?</p>
  
  <p>Can the user change the session content? (for example, if user is logged in and <code>$_SESSION["website"]</code> is "example.com", can the user change the session <code>$_SESSION["website"]</code> to "example.org" to ruin another website? If yes, how to avoid or what's the secure alternative of session?).</p>
  
  <p>And please tell me what is session hijacking and how can this affect my site and also, how to make session_id dinamically to change?</p>
  
  <p>Thank you so much!</p>