[eluser]MikeW1911[/eluser]
I tried changing the cookie value for my test website, but the corresponding session value was unset. For example, in the cookie, I changed "user_id" to 2, but the "user_id" value in the session array was unset. Without cookie encryption, there still seems be an md5 hash value associated with the cookie. So someone has to do more than just changing the cookie value to manipulate session array values?
