I am building a web application where the user enters an e-mail address to log in. The e-mail address is stored in a user database and authenticates the user which is logged in. Currently I store the e-mail address after a successful login in a PHP Session variable.
The content of the application is user-based, so it should only be visible, if the user who created it, is viewing it. Therefore I thought that I could do a SQL request where I pass the e-mail address from the session variable to check the permission.
Is there any possible threat? As far as I know, the session variable cannot be modified. Is that right and what are possible attack scenarios?