Sessions - looking for a nudge

[ph3n0m]

Hi all

Basically I am doing a site for a client

Now basically its a two pronged website

1) General users can view all pages, but with limited information

2) Registered users can view all pages with all information

Now I am of the mind to use sessions for this, but tbh - I dont know how.

Currently I am just using a random number attached to the url of each page, kinda like a session - but when a user registers with the site, it captures that random number (its class on the site as ID)

WOuld session be the best thing to use, where when a registered user logs in, the random number is replaced by their registered number - thus displaying full information instead of limited information

I am just wondering should there be reference to the sessions on each page plus a check against the database to see if the random number in the url is actually a registered person number

I hope I am not confusing everyone with this and some of you will know what I am aiming for

Not looking for a complete solution just a nudge in the right direction - I can handle the coding myself if someone can possible explain how I should do this?

thanks

[groovything]

are you using the random number in the querystring?

I would avoid using the querystring for security/log in purposes because it's fairly easy to 'hack' that kind of security.

I assume you have a mySQL table with user login information?

when a registered user logs into my site, I just plug their userID, UserName, and userType into session variables and then check those variables to see what content should be displayed.

here is what I do:

$sql = "SELECT * from users where username = '$STRusername' and password = '$STRpassword'";
//execute sql query and get results     

$sql_result = mysql_query($sql) or die("The username/password combination you entered is incorrect.");  

//format results by row 
while ($row = mysql_fetch_array($sql_result)) 
   { 
   $userID = $row["userID"];
   $userName = $row["userName"];         

   $userType = $row["userType"];         

   }       

session_start();
session_register("sessUserID");
session_register("sessUserName");
session_register("sessUserType");

$sessUserID = $userID;
$sessUserName = $userName;
$sessUserType = $userType;
?>

Hope this helps

p.s. you lucky dog...you get guinness at non-import prices 😃

[ph3n0m]

Originally posted by groovything
you lucky dog...you get guinness at non-import prices 😃

pity guiness is muck - much prefer JD and coke myself 😉

[groovything]

Originally posted by ph3n0m
pity guiness is muck - much prefer JD and coke myself 😉

Ha! the grass is always greener on the other side of the ocean.😃

[ph3n0m]

indeed.

anyway thanks for that bit of code - now I am off to make it a required function to validate all users 🙂

will update this post if I have success or failure (here's hoping it is success on a Friday)