Session vars or the session ID?
The session ID can be hijacked if it is in a url and someone other than the user sees that URL. If it's in a cookie, then only if the cookie is sniffed somehow.
It isn't likely that a session ID can be spoofed, PHP creates a file of the same name as the session ID which is a long string of random chars. If there is no file with that ID, you'll get an error.
The session variables are stored in that file, so they shouldn't be available unless your code somehow permits the wrong user to see the information.
