Can a cookie harm the site in any way?

Question

PHP

1. If the incoming cookie is not sent to mysql and is not used in the database query, but is only used in the php code, can an attacker somehow harm the site?
   
2. Can an attacker harm the site by sending cookies with names (cookies) that are not used on the site and are not processed accordingly? (For example, the site only uses the login: cookie, and it will also send a1:adfksklf )
   
3. If an attacker substitutes his value in PHPSESSID, for example, what kind of code can it harm the site?
   

Answer 1

Quote from documentation :
So this setting is off by default . This means that if in this scenario you start getting several of these requests per second, each of which opens a new session, you will very quickly hit the limit on the number of open files (because session.save_handler defaults to files):
Read the PHP section on session security , there are many interesting things.