environmental variables

msound

I was wondering if environmental variables are a good way to generate user specific content on an apache web server. I use htaccess for password protection so once a user logs in apache creates a $REMOTE_USER variable, I can then use the username stored in apache to query a mysql database for content related to that user. I'm just curious since I've never read of anyone else doing this if there's anything wrong with this method authentication and dynamic content generation. Everyone seems to be using either cookies or sessions but I've found this method to be very easy. Is there anything wrong with using $REMOTE_USER to generate user specific content? Thanks.

devinemke

HTTP authentication is fine but once the user has logged in you would need to fetch their user specific data from the db on every page request. this is why sessions are a bit more elegant. as the user moves around the site you can use sessions to store other info (like the contents of a shopping cart, etc...).

Weedpacket

Well, you said it yourself - user specific data; what do they have to do with your environment? For one thing, you only have the one environment, and who knows how many users.

msound

Well, you said it yourself - user specific data; what do they have to do with your environment? For one thing, you only have the one environment, and who knows how many users.

I'm not quite sure I understand your reply. Just to clear things up let me explain exactly what I'm doing.

A buddy of mine does contract web design and he would like a client section for his website. All the client section is going to have is the client's service history. So what I did was I made him a mysql table that stores service history. The service history table has fields like:

username, service_description, date_started, date_completed, price, comments etc.

Whenever he gets a new client he assigns that client an htaccess login name to login to the client portion of his site. Now when the client logs in and goes to the Service History link the history page just queries the mysql table for all entries related to the client's htpasswd username that is stored in the $REMOTE_USER envariable.

This was just something really basic I wrote up for him and I was just wondering if there are any problems with doing it this way.