Can session variables be spoofed by the user? Do I need to use hard to guess values for things?

A Session is stored on the server - The user is just given a reference number.
A Cookie is stored on the user?s computer.

So unless the user has access to your server they can't change ANYTHING in the session. However, everything has a weakness. If you want to know what might go wrong with sessions I suggest you look on google. Some of the information is a little hard to explain without a long paper on it.

I recommend you store your sessions is a DB.

Okay, thanks for your help.