Can hacker hack session_data?

[eluser]Unknown[/eluser]
Hello, i just want to clear session storages because i don't understand it thoroughly, so if someone can explain it to me, im very thankful. i want to know if a malicious user can change the data inside a session file. i have the sess_use_database and sess_encrypt_cookie set to TRUE.

for example scenario, i have an upload controller which checks the session data of the uploading user. the uploaded file will go to the user_id from the session storage. if a malicious user can change the session data's user_id to different user, then the uploaded file will go to different user. is this possible?

what can i do to protect my application from this activity?