title: PHP Can a client ever set $_SESSION variables?
body: <p>Is there any scenario where a client/user/hacker can set <code>$_SESSION</code> variables themselves (excluding malicious software running on a server computer. I mostly mean via the browser)?</p>
  
  <p>The reason I ask is because of <a href="https://stackoverflow.com/questions/4162519/php-session-var-enough-for-user-auth">this question</a> that I asked a few days ago.  Since then I have become pretty confused on the subject, but I've got a better idea of session fixation and hijacking.  </p>
  
  <p>To put it as simply as possible, if I validate every page with something like <code>isset($_SESSION['validated'])</code>, is it secure?</p>