Need advice on url security

[clairian]

Hi,

 

I am quite new to php and need to secure my site as it will hold personal info.

 

For example, when a user selects:

<a href="EditTenantFormT.php?UID=<?php echo ($row['UID']) ?>">Edit My Details</a>

 

It passes them to a page to edit their data. However, as the 'user id' is passed through the URL this is not secure as the db can be queried through the URL:

http://localhost/OceanBlue/EditTenantFormT.php?UID=20

 

What would be the best (and easiest) method of stopping the UID being shown in the URL. I did try urlencode/urldecode but it didnt seem to work - is this the best method?

[kts]

You could always send the ID as a Post variable so its not in the URL ... also make it a session variable

[papaface]

If you want to go up the encryption route do base64_encode base64_decode . But I would personally make another section of code that checks they have permission to access the record.

[MadTechie]

to explain on papaface post (which i recommend),

personally i store the userid in a session ie $_SESSION['UserID'],

then have a routine to check the access level (if that level allows me to edit others records then i accept the get "UserID=xxx" from the URL if not i ignore it.. and set theID back to the UserID

 

ie

<?php
start_session();
$isAdmin = checkaccess($_SESSION['UserID']);

if (isset($_GET['UID']) && ($isAdmin === true))
{
$uID = $_GET['UID'];
}else{
$uID = $_SESSION['UserID'];
}

//Load records with $uID as the userID

function checkaccess($userID)
{
//search user ID in mySQL and get UserLevel
if ($userlevel == 1)//whatever is the Admin Level
{
return true;
}else{ 
return false;
}
}

?>