security - How secure is PHP session_start $_SESSION value as login verification? -

if user logs in , passes security checks (username, password, 2fa... whatever) , hypothetical php login system like:

session_start(); $_session['logged_in_userid'] = 1; 

how safe rely on existence of $_session value 'logged_in_userid' proof person did pass full security check? not very, i'm thinking.

if xss determine phpsessid, , manually add own local cookies. not going automatically assumed logged in when visit same system?

if - resolution record, @ login time, in _session the: remote_addr, http_user_agent , x_forwarded_for , compare @ each request time not _session logged_in_userid _session remote_addr etc etc found in current _server vars?

or flawed also?

it secure but need stuff make sure can't 'hijack' session xss example mentioned:

static protected function preventhijacking() {     if(!isset($_session['ipaddress']) || !isset($_session['useragent']))         return false;      if ($_session['ipaddress'] != $_server['remote_addr'])         return false;      if( $_session['useragent'] != $_server['http_user_agent'])         return false;      return true; } 

the function above checks ip address see if it's original user , not else.