What is the name of this (ahem .. strange) SESSION?

Question

PHP

I came across one CMS'ka, there is this: And - this is a piece of SQL query. It is read from the session and added to the main request. Just the perfect hole for SQL injection, I thought, got into the chrome session, but there is only PHPSESSID. This entry doesn't exist. But she works. How so? Does the browser hide sessions with underscores, or are such records somehow stored only on the server side?
$_SESSION ['__var']='value';
value

Answer 1

Don't confuse sessions with cookies. The session files are stored on the PHP server, the browser only stores the session id. SQL cannot be fixed directly on the client.