Question: Since every user has a unique PHPSESSID, is it possible for two users, say a to inject info into b's SESSION data using standard PHP running on the server.

Note, I am not using this for any wrong purposes. Trying to use it for chatting without DB access.

Thank you for your time.

Answer: 
Instead of farting around with what is, essentially, indirect file handling through the session system, why not go straight to the point and use text files? 

It's less vulnerable to attacks, and also less volatile, in the sense that future versions of PHP could decide to prevent this sort of session switching for security reasons (complete hypothetical, but it makes sense).
PHP’s default session handler uses only the session ID to identify the session. That makes it possible to use the session ID from another user and thus use the same session ([*Session Hijacking*](http://en.wikipedia.org/wiki/Session_hijacking)). Another attack is to prepare a session and get the victim to use that session so that the victim and attacker again use the same session ([*Session fixation*](http://en.wikipedia.org/wiki/Session_fixation)).

The base for such attacks is that you just need to know the session ID to use the session that is associated to it. Prevention techniques are to use more identification information than just the session ID. Some suggest to use the IP address (but that may change during a session) or the user agent identifier. Another technique is to hide the session ID externally by allowing only a cookie and HTTPS.

But be also aware of shared hosting. Some might use a common pool for all session data files of all cumstomers.