Question: Since every user has a unique PHPSESSID, is it possible for two users, say a to inject info into b's SESSION data using standard PHP running on the server.

Note, I am not using this for any wrong purposes. Trying to use it for chatting without DB access.

Thank you for your time.

Answer: 
Session is a simple thing that can be easily reimplemented to do as you wish. Take a look at this simple exemple I wrote some time ago: <http://pastebin.com/f3ca0ae8d>

Usage:

* `new mySession();` doing the same as `session_start();`
* `$_MYSESSION` doing the same as `$_SESSION`
* `delete mySession();` doing the same as `session_write_close();` not necessary to use unless you want to release the session before the script end.

You can make some adaptations to use it in your specific purpose, like defining the session ID yourself so you can share it among different users. As $\_MYSESSION will be common among users, you can also use regular PHP Sessions together with it to store user specific information in $\_SESSION.

[Edit]

<http://pastebin.com/f3c31737e>

Exemple: Enter the channel $\_SESSION['channelid'] and print all unread lines.

```

session_start();
new mySession($_SESSION['channelid']);

while (count($_MYSESSION['chat']) > 100) unset($_MYSESSION['chat'][key($_MYSESSION['chat'])]);

while ($line = $_MYSESSION['chat'][$_SESSION['lastread']++])
        echo "$line  
";

```

Exemple: Talk to the channel.

```

session_start();
new mySession($_SESSION['channelid']);

$_MYSESSION['chat'][] = $_SESSION['myname'] . ' says, "' . htmlspecialchars($_POST['message']) . '"';

```

etc...
PHP’s default session handler uses only the session ID to identify the session. That makes it possible to use the session ID from another user and thus use the same session ([*Session Hijacking*](http://en.wikipedia.org/wiki/Session_hijacking)). Another attack is to prepare a session and get the victim to use that session so that the victim and attacker again use the same session ([*Session fixation*](http://en.wikipedia.org/wiki/Session_fixation)).

The base for such attacks is that you just need to know the session ID to use the session that is associated to it. Prevention techniques are to use more identification information than just the session ID. Some suggest to use the IP address (but that may change during a session) or the user agent identifier. Another technique is to hide the session ID externally by allowing only a cookie and HTTPS.

But be also aware of shared hosting. Some might use a common pool for all session data files of all cumstomers.