title: Bad handling of PHP sessions variables?
body: <p>I'm currently using the following code in my cms to check if visitor is logged in as admin so that he can edit the current page:</p>
  
  <pre><code>if($_SESSION['admin']=="1")
  {
          echo "&lt;a href="foobar/?update"&gt;edit&lt;/a&gt;";
  }
  </code></pre>
  
  <p>But I'm worried that the code is unsafe. Can't $_session variables easily be modified by the user?</p>
  
  <p>What would be a safer practice?</p>