Is it safe to use sessions for user validation?

Thanks for all your answers!

In my query example, $user_id is not user input, but a value taken from the session, which was added there from a query that takes user Ids (which are always integers).

My fear is that an attacker would be able to change the session data and impersonate other users, e.g. changing his ID (e.g. "201") to 1, 2, 3, ... 100000 and thus causing a lot of damage. Would something like that be possible?

@InsiteFX long-term persistence is a nice-to-have feature, but for now, there are other things to be done