I am working on a project where I am using PHP_SESSION, Somewhere I heard that PHP_SESSION are quite unsafe for passing valuable data so I have to know what are the security flaws, how it can be hacked and how to protect yourself from them, Every Simple, Brief and Usable answer should be appreciated.
$_SESSION variable in PHP is a temporary block of memory assigned to each specific user separately. Its purpose is not to be secure, it is meant to store session information.
If you are thinking of using it to store long lasting data, or data that needs to comply with the CIA triad I suggest you look into something else. There are variables in PHP's config related to garbage collection that may affect the life cycle of your session data, but most importantly, all session data is stored in the /tmp folder (unless configured otherwise), so if an attacker gains access to the file system they will be able to fetch all content from the
$_SESSION variable of every user.
You may consider instead, storing an encrypted version of everything sensitive, as explained here
Another thing to consider is to override the default way of handling
$_SESSION, in PHP you can define your own session handling functions. With this you may store your sessions in a remote database for example, adding an extra layer of security. Of course if your file system is compromised the log in credentials to that database most likely will be compromised as well, but at least its an extra layer of security.