Login System

I use a system that sets a variable $_SESSION['loggedin'] = "y". Then the other pages check that this session variable is set to "y" before showing content. Is that safe, or is there some way for a person to trick the system into thinking they have that variable set to "y"?