How does the session id work?

[Holgerwa]

If I start a session with session_start() and there was no session before, a new session id is created and from now on handed out to all pages that follow the current one (if I understand this correctly).

But doesn't that mean that any given page will take the session id that is handed to it and use it as a valid session?
In this case, an intruder could just pass any session id to a page and prevent it from creating a new session when it really should.

What am I missing? How does it really work?

[405hp]

PHP: Introduction - Manual

Basically session is a temporary var array that is stored on the server and accessed via the session id returned from the client. If the id returned is invalid then the session wont exist on the server to continue.

[Holgerwa]

Thanks for your answer, it's getting clearer now... :-)