Session security

It's a safe as the PHP configuration on the server. The session ID is stored in the cookie. The session data is stored on the server. Session data is stored by default in the /tmp directory on a typical Linux or BSD host.

You need to be aware of cross-site scripting attacks and their use to commit session hijacking. An attack can be carried out against web sites that allow unfiltered HTML to be posted. The attacker places some JavaScript on the page that captures the session cookie from the user’s browser and fetches a 1 pixel image from a remote server. The script appends the cookie content (containing the session key) to the image URL. The attacker then retrieves the session ID from his logs and uses it to access your web site under the credentials of the hijacked session.

Note that the attack I just described is not specific to PHP sessions!

Frank

I do a lot of work on some pages with javascript as well.

1) Can it access the same session information or is it simply not possible?
2) Say I were to put "accountLevel = 5;" inside a <script> in my header file. This is EASILY changed through "javascript:accountLevel = 10" in the address bar. What can I do to combat this or do some other method?

I think what FrankR is saying is that this information is not stored on the client machine, it's stored on the server (in the /tmp directory). The only thing stored on the client is the sessionid. You don't need to use MySQL to store your session information: that's what FrankR is saying, you can use a server side cookie instead.

If you did put more information into your client side cookie (and treat that as being reliable) then yes, you are asking for trouble. Never trust what the client sends you! Using $_SESSION will not lead to anything other than the sessionid being stored on the client.