Is it possible to modify the $_SESSION variable?

Question

Is it possible for an malicious user to set the $_SESSION (in php) variable to any value he wants?

Answer 1

Not typically, but they could if, for instance, you had a remote code execution vulnerability in your PHP.

Answer 2

Yes, by using another user's session data, as shown here: http://phpsec.org/projects/guide/4.html

Answer 3

Yes, when REGISTER_GLOBALS in on.