I have a site where a user can create an account and log in. When the user logs in, after I validate the user's password and username, I give them a PHP session variable containing their username. That is how they access features on my site such as creating a blog post and changing their user bio.
Can someone wanting to get on my site through another person's account fake a session variable containing the username of the user? If so, how can they do this? And are there any ways to prevent this?