Global vars are in general much more secure than those unregistered ones. As long as you don't store your raw password in a session and make enough checks, you should be on the safe side with SESSION vars.
If you don't know enough about login and data checks, I'd recommend you to check out PHPSecurePages (
http://www.phpsecurepages.com), it should show you how to handle that stuff.