You did not specify what the ERROR variable is. If true indicates an error, set_login_session can be significantly reduced to
$_SESSION['login']['logged_in'] = 1; return !ERROR;
and the external code is
return set_login_session( $passhash );
There is no need to make such explicit comparisons of bool values.
And yes, this is absolutely true for setting variables in functions, but make sure that the variable is always set, regardless of the code path, so there are no uninitialized / faulty variables used in your code. Otherwise, you are asking for problems, or at least big fat warnings in the output of the script.
The superglobal amount of $ _SESSION must be present if the session has begun. If it didn't have ['login'] ['logged_in'], that's fine.
source share