joeNmass

Thank you for all your help. I tried to understand what some of you have suggested, and tried changinging a few things as suggested but still don't have it working the way it should. Please let me explain my situation a little bit more in detail. When someone logs into their account everything is working correctly and as it should. They can see, edit and delete whatever information they like of theirs. The issue is when a user has the option of changing one of multiple similar items in a database. Lets say that the user has 5 different widgets that has various information about it and he would like to edit the description for one of them. He navigate to a page that lists all of his five widgets that he has on file. He proceeds to choose the widget that he would like to edit (lets say the id number is 3). When he clicks on a link besides the widget that he wants to edit, the address bar would show http://www.mywebsite.com/edit_record.php?id=3 Everything is as it should be. He makes his corrections and submits the form. The database is updated correctly as it should. But here is the problem. If this person has intension of malice, when the address bar shows http://www.mywebsite.com/edit_record.php?id=3 and he changes the "3" to "67" and presses enter button, he in effect now has complete control of item #"67" which does not belong to him but another user. And he can successfully change whatever information he wants on item "67". Please excuse my ignorance if this seems simple to you to resolve but not for me. I am just trying to understand and learn why this is happening and how to prevent it.

Still trying to figure this out. No Luck :'( Anyone with ideas?

I am thinking maybe my queries have to be updated to something like adding "WHERE session_Id=". Is this something I can add to my queries so only those who are logged in can only access their pages no matter if they try and go around it by editing the address bar to a different ID?

I just discovered that I have a major security flaw with my website. Anyone who logs in to the website can easily access other users information as well as delete and edit other users information just by changing the ID variable in the address bar. I have user ID Session started on these pages but still people can do anything they like with other users information just by editing the address bar. For example if your logged in in the address bar of www.mywebsite.com/delete_mystuff.php?id=5 and change the "5" say to a "9" then you will have access to user#9 information. Every important page that I have has this code: session_start(); if (!isset($_SESSION['user_id'])) { // Start defining the URL. $url = 'http://' . $_SERVER['HTTP_HOST'] . dirname($_SERVER['PHP_SELF']); // Check for a trailing slash. if ((substr($url, -1) == '/') OR (substr($url, -1) == '\\') ) { $url = substr ($url, 0, -1); // Chop off the slash. } // Add the page. $url .= '/index.php'; ob_end_clean(); // Delete the buffer. header("Location: $url"); exit(); // Quit the script. } else { //Else If Logged In Run The Script if((isset($_GET['id'])) && (is_numeric($_GET['id']))) { $id = (int) $_GET['id']; } elseif ((isset($_POST['id'])) && (is_numeric($_POST['id']))) { $id = (int) $_POST['id']; } else { echo ' No valid ID found, passed in url or form element'; exit(); } What am I doing wrong? Please help if you know how to correct this. Many thanks in advance.

Hi mjdamato, You are an amazing genius with this stuff. That worked perfectly. I studied your code so I could understand how it relates from one line to the next and it all makes sense now (it's like being perplexed watching a magician do his amazing tricks but once he shows you how its done you say "oh, so thats how its done"....lol . Thank you again and have a great weekend.

Thank you very much for your response mjdamato. Please excuse my ignorance in this matter as I am also a little embarrassed for not knowing (kinda of a newbie). I have the first query working correctly as you suggested. Here it is as I have it written: $q="SELECT *, COUNT(miles) AS limit_amt FROM mpg WHERE vehicle_id='$id'"; $result = mysql_query($q) ; while($row = mysql_fetch_array($result)){ $limit_amt=$row["limit_amt"]; $amt=($limit_amt - 2); echo $amt; echo '<br/>There are'; echo $amt; echo 'items.'; echo "<br />"; The second query is where I have a problem. I don't under stand how to use the " as data_set" at the end of the query. I have never used something like that at the end of a query before. This is how I have the second query written, but with no luck. $q2="SELECT AVG(miles) AS av_miles FROM (SELECT miles FROM mpg WHERE vehicle_id='$id' ORDER BY date DESC LIMIT $limit_amt) as data_set"; } $result = mysql_query($q2) ; // Print out result while($row = mysql_fetch_array($result)){ $data_set=$row["data_set"]; echo $data_set; echo '<br/>There are'; echo $data_set; echo 'items.'; echo "<br />"; Any further suggestions would be great....and thank you again.

Hi everyone, I hope someone can give me an answer to problem that has eluded me for about 2 weeks. I just can not find the answer. My problem is that I have a database that I want to return the average of a column BUT the average number that gets calculated can not include the oldest two records that were entered in that particular column. In other words, if I have ten entries in a column only the latest 8 entries will be used to calculate the returned average. Here is the basic query I am using: $result = mysql_query("SELECT *, avg(miles) AS av_miles FROM mpg WHERE vehicle_id='$id' "); Thank you for help in advance.