note 8096 deleted from Session handling functions by ronabop

What prevents a user from adding a string onto a the URL in their browser to, say, increase their access level? i.e., John has logged into the site at level 1. What if he puts "http://this.site/page2.php?level=3" into his browser? Can he override the value of $level that is stored in the session? On those lines, what prevents someone from not logging in at all, and just spoofing the session variables in their URL string? Is that was the isset() or session_is_registered() functions are helping prevent? Sorry, I'm fairly new to sessions, and it just seems that they'd be too easy for a user to 'trick'... I hope I'm very wrong about that. Can anyone point me to a good article/book on sessions that may alleviate my fears? Thanks!