Question: Since every user has a unique PHPSESSID, is it possible for two users, say a to inject info into b's SESSION data using standard PHP running on the server.

Note, I am not using this for any wrong purposes. Trying to use it for chatting without DB access.

Thank you for your time.

Answer: 
Read up on [session fixation](http://www.tuxradar.com/practicalphp/17/1/11)
I can't say for sure but since session data is by default stored in a file, if your app knows the session id of the other user you could replace in the session file that was written by the standard session functions with altered data. The next time the other user accesses a script the altered session data will be loaded.

But you are risking all sorts of race conditions and conflicts if you just do this on top of the built in session handling. You will probably want to replace the session handling functions with your own so you can deal with all of these issues. The issues are probably much more complex than they appear on the surface.

See: [<http://www.php.net/manual/en/session.customhandler.php>](http://www.php.net/manual/en/session.customhandler.php) for information about custom session handlers