Is it possible to access the `session` table using db_query/db_update/db_insert? is there a security feature that is preventing me from doing anything with sessions?

I'm pretty sure this is a bad idea, but I'm switching users around after login.

User A logins in using their credentials, but we switch them to be User B.

Perhaps there's a better way to do this and I don't need to directly change sessions at all.
Yes, it's a bad idea :)

No, there are no extra security measures in place that would stop you having access to the sessions table (certainly nothing that Drupal is imposing, and if your site is working then Drupal must be able to read/write to that table).

If you want to switch users programatically I can't think of a better way than how the Devel module does it:

function devel_switch_user($name = NULL) {
  global $user;

  if ($user-&gt;uid) {
    module_invoke_all('user_logout', $user);
  }
  if (isset($name) &amp;&amp; $account = user_load_by_name($name)) {
    $old_uid = $user-&gt;uid;
    $user = $account;
    $user-&gt;timestamp = time() - 9999;
    if (!$old_uid) {
      // Switch from anonymous to authorized.
      drupal_session_regenerate();
    }
    $edit = array();
    user_module_invoke('login', $edit, $user);
  }
  elseif ($user-&gt;uid) {
    session_destroy();
  }
  drupal_goto();
}


Even if you don't have devel installed (which obviously you shouldn't on a production server anyway), just make a copy of the function in a custom module and tweak it to your needs.