How safe is the CI native session?

[eluser]Maglok[/eluser]
By default you can change a cookie on your harddrive, but CI has a toggle in the config to mirror all the sessions in the database that you absolutely must use if you plan to use the session to authorize people. It will destroy any session that gets tweaked with, cause it doesn't match the database.

The bit about SQL injections is kinda moot, CI handles that sorta thing quite well, xss-cleans, etc. the works.

EDIT: Looks like someone posted while typing.