Page1.php:
Page2.php
Session could be modified in different occasions.. See this -> Session Poisoning