PHP code to check if user has right to download certain files

[aaron118]

Hi guys, I'm in need of some coding help to try and make my first script as I have just started to learn PHP I am still a PHP noobie. I'm trying to create a customer download script, so my customers can log into a customer area on my site and download the files they’ve purchased.

First off, in order for someone to purchase a product at my site they have to go to a page called order.php there they have to enter their first and last name, email, desired username (to login to the customers area) and then they have to tick the checkboxes for the products they want. The user does not have the option to enter a password though; the script will make them one up with random digits (using the mt_rand function) so they don’t know their password so they can't login. This is so I know they’ve paid me before they can login to get their files, so then I can send them this generated password to access the customer area. I will use the mt_rand function to generate a random password and the variable for the password will be $userpass. So don't worry about the password bit as I know what I’m doing, I think lol. The form is then posted to another page called checkout.php where the script adds up the total amount, checks that all fields are filled and at least one product is selected. The user then presses the "Pay Now" button and it takes them to paypal to make the payment but also inserts their info into the database. I need the code to insert all the users info into a database. I take it I would query it like this:

$query = "insert into customers values
('".NULL."', '".$username."', '".$userpass."', '".$firstname."', '".$lastname."', '".$email."', '".$porders."')";

The NULL at the begining is where the customerid will go and as that is set to "auto_increment" nothing has to be inputted there as it will automatically set a unique ID (but you probably know all that already).

The product(s) that the user is aloud to access are stored in a column called porders (Product Orders), the script identifies which products they are aloud to access by the products unique ID(s) stored in the porders column. The customers unique ID, first and last name, email, password, username and porders are all stored in a table called customers. There is also a table called products which stores a products ID, name, description and price. What I need to know is how to insert more than one product ID into the porders column in the customers table (encase they order more than one product)? Also I then need the PHP code to check (once the user is logged in) what files the user has access to and if they do have access to a certain file(s) then an url to download the file is echoed (well I will work on how to secure my files later, just need this bit done first). What else might I need to add, is what I want possible? Thanks to anyone who might help.

Thanks again,

[briscoe]

I think it will be better to structure your database differently to allow for multilple entries for one customer id. Using three tables instead of one:

Table 1: Customer
customer, integer, no null default nextval
firstname, text
lastname, text
username, text
password, text
(customer_pkey primary key)

Table 2: Products
product, integer, not null default nextval
title, text
description, text
price, numeric
(product_pkey primary key)

Table 3: Orders
customer_id, integer
product_id, integer
(foreign key (customer_id)
(foreign key (product_id)

This way your php script will take the customer_id and loop if there is more than one item chosen.

[aaron118]

Thanks for your reply. But what would the PHP code be to check the database, to see if they have permission to download a certain file?

Thanks