Is it safe to use sessions for user validation?

I have a website with user registration & login. On login, after username and password are validated, I create a session like this:

PHP Code:

$this->session->set_userdata('user_id', $user->id); 


and then in Controllers and Modals I use this data to validate or identify users:

PHP Code:

$user_id = $this->session->userdata('user_id');

if ($user_id == '') {
    // user has not logged in and shouldn't have access to user-area pages.  
    ...
}

$query = "SELECT * FROM users WHERE user_id='" . $user_id . "' ..."; 


Is this method safe or good practice? Is it possible for malicious users to manipulate the session data?