Question: Since every user has a unique PHPSESSID, is it possible for two users, say a to inject info into b's SESSION data using standard PHP running on the server.

Note, I am not using this for any wrong purposes. Trying to use it for chatting without DB access.

Thank you for your time.

Answer: 
Read up on [session fixation](http://www.tuxradar.com/practicalphp/17/1/11)
Session is a simple thing that can be easily reimplemented to do as you wish. Take a look at this simple exemple I wrote some time ago: <http://pastebin.com/f3ca0ae8d>

Usage:

* `new mySession();` doing the same as `session_start();`
* `$_MYSESSION` doing the same as `$_SESSION`
* `delete mySession();` doing the same as `session_write_close();` not necessary to use unless you want to release the session before the script end.

You can make some adaptations to use it in your specific purpose, like defining the session ID yourself so you can share it among different users. As $\_MYSESSION will be common among users, you can also use regular PHP Sessions together with it to store user specific information in $\_SESSION.

[Edit]

<http://pastebin.com/f3c31737e>

Exemple: Enter the channel $\_SESSION['channelid'] and print all unread lines.

```

session_start();
new mySession($_SESSION['channelid']);

while (count($_MYSESSION['chat']) > 100) unset($_MYSESSION['chat'][key($_MYSESSION['chat'])]);

while ($line = $_MYSESSION['chat'][$_SESSION['lastread']++])
        echo "$line  
";

```

Exemple: Talk to the channel.

```

session_start();
new mySession($_SESSION['channelid']);

$_MYSESSION['chat'][] = $_SESSION['myname'] . ' says, "' . htmlspecialchars($_POST['message']) . '"';

```

etc...