no need isset and blank chk there
you are chking same thing many times
if(in_array($_GET['lang'], $available_langs)) { $_SESSION['lang'] = $_GET['lang']; // Set session }
this is enough
there is no word 'assumption' in programming. he has not explained there session hacking prevention feature is available or not. How would you say if he is correct.