title: php5 $_SESSION security
body: <p>I read sessions and security questions on stackoverflow, and much beyond.  I think I know the answer, but I want to confirm it with one concise  simple question--security is too important.</p>
  
  <p><strong>Conjecture</strong>: My black hat web visitor does not have direct access to his $_SESSION contents.</p>
  
  <p>that is, after my server executes</p>
  
  <pre><code>  $_SESSION['myuserprivilege']='user' ;
  </code></pre>
  
  <p>I can assume that even the most clever blackhat cannot somehow find out even that my code did this, interrogate to what my php program set his server $_SESSION to (both keys and contents), or (much worse) engineer <code>$_SESSION['myuserprivilege'] = 'admin'</code>.  only my own server php code can do so.</p>
  
  <p>I still have to be concerned that a blackhat can steal the cookie of a different admin user ( => https and session rotation).  but that's a different issue.</p>
  
  <p>correct?</p>