Question: Since every user has a unique PHPSESSID, is it possible for two users, say a to inject info into b's SESSION data using standard PHP running on the server.

Note, I am not using this for any wrong purposes. Trying to use it for chatting without DB access.

Thank you for your time.

Answer: 
I'm assuming you want to somehow have A chat to B by sending a message which gets placed into B's session.

First of all, A needs to learn B's session ID, perhaps by selecting their name from a list. You'll almost certainly want to encrypt these session ids, otherwise you have created a nice security hole!

So, A posts data to the server containing the target session id, and a message. Here's how we could temporary switch session ids to write that data into the target session:

```
//get data from form - I'll leave the encryption of the target
//session id up to you!
$target_session_id=decryptSessionId($_POST['target']);
$message=strip_tags($_POST['message']);

//remember our "real" session id and close the session
$original_session_id=session_id();
session_write_close();

//open the target session
session_id($target_session_id);
session_start();

//add message to target session
$_SESSION['chat'][]=$message;

//close target session
session_write_close();

//reopen the "real" session
session_id($original_session_id);
session_start();

```
PHP’s default session handler uses only the session ID to identify the session. That makes it possible to use the session ID from another user and thus use the same session ([*Session Hijacking*](http://en.wikipedia.org/wiki/Session_hijacking)). Another attack is to prepare a session and get the victim to use that session so that the victim and attacker again use the same session ([*Session fixation*](http://en.wikipedia.org/wiki/Session_fixation)).

The base for such attacks is that you just need to know the session ID to use the session that is associated to it. Prevention techniques are to use more identification information than just the session ID. Some suggest to use the IP address (but that may change during a session) or the user agent identifier. Another technique is to hide the session ID externally by allowing only a cookie and HTTPS.

But be also aware of shared hosting. Some might use a common pool for all session data files of all cumstomers.