[Resolved] Multiple Users of same form

passagewds

I need to have one form that multiple people can use to control their own group material. I need to ensure that member 'A' only is able to control group 'A' material and so on.

I don't want to trust cookies, what would anyone like to suggest as a plan to take care of this?

It is probably simple, but hopefully someone will have a minute to help me out.

Mikey

OhLordy

Well there are three ways of managing it.

You can use cookies (not sure why you don't like them, I think they're very tasty 😉 )
You can use sessions (without cookies, storing data in a database)
You can use POST data (have every link as a form submit and pass the data that way)

The POST data aption is not very secure because you're passing the data (probably their user_id and password) every time they do anything. The sessions method is quite good but I find it a bit of a hassle to set up. The cookies method is easy and secure.
Hope This Helps
Rob

stolzyboy

once you get going on sessions, they are really much easier to
work with than cookies, and much harder to spoof a session id,
since it's on the server, than to spoof a cookie, which resides
on the users machine

there are some decent login script out there, and if you can't find one go to this thread, it may help you out with the session bit anyway

passagewds

Thanks for the ideas

I can see that sessions are the way to go but how would you know which group a particular session was restricted to?

From what I understand of sessions, it is only one variable.

would output buffering help to make the information more secure?

I hope that makes sense.

passagewds

oops this second post an error

stolzyboy

no ob would not make it more secure and with your session group
question

you simply after a person logs in, set the session equal to their username or whatever so you can see them apart from others

passagewds

so what you are saying is to replace the session id with their username? is that secure?

what about the idea of setting a session variable equal to their username?

stolzyboy

what about the idea of setting a session variable equal to their username?

that is essentially what i told you to do, and you won't be messing with the session id, that just keeps track of what session
you are using and if it ends it will destroy the session id

you need to use your script to check what session is available
to what peeps, did you check out the login script i supplied at
the other thread, the initial concept is there, and it will work
with a mysql driven login system, i just did that one for
instructional purposes

passagewds

I have the script you put up earlier and it is making sense.

What do you mean by peeps?

so I set a session variable equal to their username and then use that to control them in the site.

I have about 1300 members and only 50 or so have control over content. I am going to set up the table so that they have a username, region, and a access level code such as 101 which would represent Executive|National|Regional| access. That means that this member would have access to Executive reports, and the ability to change regional content (based on the region field)

I will then make one Ultimate control section (using htacess) that would allow the webmaster to assign which users to which sections.

Does that make any sense?

stolzyboy

yeah, that should work fine, and

peeps = people // geek speak, sorry