[PHP] Session Variables

[Jason Bell]

Is there anyway to prevent session variables from being overwritten by a get string?

I'm wanting to use sessions for security/login, but I'm finding that I can bypass this 
very easily. For example, I want to hide menu items based on security level, so I use 
something like this:

if ($HTTP_SESSION_VARS["sess_auth"] > 2) { print "<BR><A HREF=/control/newsed.php>News 
Editor"; };

which works, however, it can be bypassed if someone just enters the value in the url 
like so:

http://secured.site.com/index.php?sess_auth=admin

is there any way around this using sessions?  Is there a far more suitable method?

Thanks!

Jason Bell