So I just discovered a BIG "No-No" while creating a login script on a dev project I'm working on.

When setting a cookie, for the user\_ID and encrypted password, I noticed that with a simple extension on Google Chrome (or Mozilla Firefox for that matter), I was able to edit the user ID cookie to another user's User ID, and access the site Like I was them. 

Does anyone have any pointers as to what route I need to take so this won't occur? Please let me know if more information is needed.