How can session variables be manipulated from outside the application in PHP?

Session variables can be manipulated from outside the application if the session ID is known or stolen. To prevent this, you can regenerate the session ID after a user logs in or performs a critical action. This will invalidate the old session ID and make it harder for an attacker to manipulate the session variables.

session_start();

// Regenerate the session ID
session_regenerate_id(true);