isolating users to their respective data info

Adr64

Hello, this is my first post here and glad that this place exists!

Anyways, hope I can get some help on this... I use PHP & Dreamweaver and trying to figure out what's best way to have users log-in and be able to make it so users have access ONLY to their own respective listings, where they view specific info that they enter and modify as need be. I do have a database and user's table, worked out, authorization by levels, a basic CMS page where clients can add/modify/delete their own entries... BUT, what is best way to isolate access to each logged-in user's CORRESPONDING info?? by sessions ID? by passing thru each user's ID/PW combo to automatically pull-in their info? just not sure if that is the correct way, security and process wise...

well, that's it.. appreciate any feedback

Roger_Ramjet

I do this by login and sessions. I create a session var that is used in every query and only retrieves data from the db when the corresponding var is matched. That way, if the session or session var is invalid then no data is retrieved.

Have a read of Kevin Yank's article on controlling users and access with sessions. The code in the article can be used as is, or modified if neccessary.

In my case it is essential that each of our clients can only see their own data, but each client may have several users. Each user therefore has a client id which I store as a session var. This is then included in all queries and only that client's data can be retrieved. The access control script must be included in all pages that access the db.

Adr64

thanks for the fast reply Roger...
Gonna check out Kevin Yank's article and see if I can work it out...