[logicPwn]

This is my own login logic for cookies. Sessions are not editable by users as said above. In my table I make a row for UUID and use uniqid(); to have PHP generate a unique key. Then I store the users name and UUID in cookies and store the unique ID in the DB. Then in your script make sure the UUID matches with the cookie. There is no way for them to insert the UUID in the DB without some other flaw in your script.