How secure are session variables?

Question

$_SESSION

Answer 1

with a cookie, a hacker can steal the session simply by using fairly simple XSS techniques.

Answer 2

@Nipun Shihara But session ID's are stored as cookies which aren't that safe.

Answer 3

I advise you to encrypt any value for sensitive information. 😉