I am learning PHP sessions, and am wondering: should I connect to my user database on every page to check if the user is logged in, or is checking if the sesson exists enough? In other words, could someone exploit my website by hijacking a session?

its fine using sessions to check a logged in user

This is normally how its done

I dont think its possible to hijack a user session considering the session itself is held on the server rather than the browser.

I normally put "most" of my users data in a session.

and then that data is enought for me to get more data using a sql query.