title: Using Session variable in SQL statements
body: <p>I'm wondering if it's safe to use a Session variable in SQL statements.</p>
  
  <p>I'm using this piece of code: </p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>$req = $db-&gt;prepare('SELECT Name FROM Users WHERE Years = :Years');
                  $req-&gt;execute(array(
                  'Years' =&gt; $_SESSION['years']
                  ));</code></pre>
  </div>
  </div>
  </p>
  
  <p>Are the users able to modify the session variables?</p>
  
  <p>Thanks!</p>