Retrieving Database Info Based On User logged in

[saran.tvmalai]

I have two tables.

 

Table Name:Users

 

Fields:

 

User_name

user_email

user_level

pwd

 

 

2.Reference

 

Fields:

 

refid

username

origin

destination

 

user_name in the users table and the username field in reference fields are common fields.

 

 

 

There is user order form.whenever an user places an order, refid field in reference table will be updated.So the user will be

provided with an refid

 

Steps:

 

1.User needs to log in with a valid user id and pwd

2.Once logged in, there will be search, where the user will input the refid which has been provided to him during the time of order placement.

3.Now User is able to view all the details for any refid

3.Up to this we have completed.

 

Query:

 

Now we need to retrieve the details based on the user logged in.

 

For eg: user 'USER A' has been provided with the referenceid '1234' during the time of order placement

user 'USER B' has been provided with the referenceid '2468' during the time of order placement

 

When the userA login and enter the refid as '2468' he should not get any details.He should get details only for the reference ids which is assigned to him.

[Gheeda]

Simply check USERS name against the name of the User in your reference database place it in the results of submitting the refid.

 

Something as simple as

 

if ($YOURUSERARRAY['User_name'] !== $YOURREFARRAY['username'])
{
  echo "Your account holds no records of this reference number !" ;
  echo "<br><a href='refidsearch.php'>Re-enter your reference number</a>";
  exit;
}

 

 

I believe that'd do the trick.

[beta0x64]

I think you should use session variables instead but yea...

 

If you were planning on doing it through a database query, you must watch out for them to get access by changing the ref id to malicious code...

 

Just a warning