Question: Since every user has a unique PHPSESSID, is it possible for two users, say a to inject info into b's SESSION data using standard PHP running on the server.

Note, I am not using this for any wrong purposes. Trying to use it for chatting without DB access.

Thank you for your time.

Answer: 
Session is a simple thing that can be easily reimplemented to do as you wish. Take a look at this simple exemple I wrote some time ago: <http://pastebin.com/f3ca0ae8d>

Usage:

* `new mySession();` doing the same as `session_start();`
* `$_MYSESSION` doing the same as `$_SESSION`
* `delete mySession();` doing the same as `session_write_close();` not necessary to use unless you want to release the session before the script end.

You can make some adaptations to use it in your specific purpose, like defining the session ID yourself so you can share it among different users. As $\_MYSESSION will be common among users, you can also use regular PHP Sessions together with it to store user specific information in $\_SESSION.

[Edit]

<http://pastebin.com/f3c31737e>

Exemple: Enter the channel $\_SESSION['channelid'] and print all unread lines.

```

session_start();
new mySession($_SESSION['channelid']);

while (count($_MYSESSION['chat']) > 100) unset($_MYSESSION['chat'][key($_MYSESSION['chat'])]);

while ($line = $_MYSESSION['chat'][$_SESSION['lastread']++])
        echo "$line  
";

```

Exemple: Talk to the channel.

```

session_start();
new mySession($_SESSION['channelid']);

$_MYSESSION['chat'][] = $_SESSION['myname'] . ' says, "' . htmlspecialchars($_POST['message']) . '"';

```

etc...
I can't say for sure but since session data is by default stored in a file, if your app knows the session id of the other user you could replace in the session file that was written by the standard session functions with altered data. The next time the other user accesses a script the altered session data will be loaded.

But you are risking all sorts of race conditions and conflicts if you just do this on top of the built in session handling. You will probably want to replace the session handling functions with your own so you can deal with all of these issues. The issues are probably much more complex than they appear on the surface.

See: [<http://www.php.net/manual/en/session.customhandler.php>](http://www.php.net/manual/en/session.customhandler.php) for information about custom session handlers