Answer for Question 2:
Lets first clarify on the terminology.
Session ID's are often used to identify a user that has logged into a website, they can be used by an attacker to hijack the session and obtain potential privileges. A session ID is often a long, randomly generated string to decrease the probability of obtaining a valid one by means of a brute-force search.
Example session id in GET:
Session [Key,Value]: The user is typically identified by the server using the session ID sent via cookie or through GET/POST parameters. For example,lets take a case where session data on the server are stored in files like
This file contains data stored in [Key,Value] pairs for that sessionid.
And on server side Welcome page validation may be like below
session_id( '$_GET['SESSIONID'] ); //Sets session id to the value received via GET parameter i..e session_id('AIsdlasdklMVgyfrfksoskeikskZPF63erf')
$username=$_SESSION['username'] //sets $username to Alice
echo "Welcome".$username; //Prints "Welcome Alice"
username is a Key and
Alice is the corresponding value for that key in session variable.
Answer for Question 1:
Yes it is dangerous if the session id is in URL.
Also, its similar having your username or password in URL via GET.
Even though the session is for just valid for short period of time (from login to logout/session expiry) , it can be missused if the attacker can get the sessionid while its valid.
Once he gets the session id, he can send spoofed the requests on the users behalf.
In above example if attacker gets the session id of Alice and send requests using it he too will get
"Welcome Alice" message.