Is it possible to access the `session` table using db_query/db_update/db_insert?
Yes, it's a bad idea :)

No, there are no extra security measures in place that would stop you having access to the sessions table (certainly nothing that Drupal is imposing, and if your site is working then Drupal must be able to read/write to that table).

If you want to switch users programatically I can't think of a better way than how the Devel module does it:

function devel_switch_user($name = NULL) {
  global $user;

  if ($user-&gt;uid) {
    module_invoke_all('user_logout', $user);
  }
  if (isset($name) &amp;&amp; $account = user_load_by_name($name)) {
    $old_uid = $user-&gt;uid;
    $user = $account;
    $user-&gt;timestamp = time() - 9999;
    if (!$old_uid) {
      // Switch from anonymous to authorized.
      drupal_session_regenerate();
    }
    $edit = array();
    user_module_invoke('login', $edit, $user);
  }
  elseif ($user-&gt;uid) {
    session_destroy();
  }
  drupal_goto();
}


Even if you don't have devel installed (which obviously you shouldn't on a production server anyway), just make a copy of the function in a custom module and tweak it to your needs.