Question: Since every user has a unique PHPSESSID, is it possible for two users, say a to inject info into b's SESSION data using standard PHP running on the server.

Note, I am not using this for any wrong purposes. Trying to use it for chatting without DB access.

Thank you for your time.

Answer: 
Read up on [session fixation](http://www.tuxradar.com/practicalphp/17/1/11)
Instead of farting around with what is, essentially, indirect file handling through the session system, why not go straight to the point and use text files? 

It's less vulnerable to attacks, and also less volatile, in the sense that future versions of PHP could decide to prevent this sort of session switching for security reasons (complete hypothetical, but it makes sense).