Security Concept

byw

I am designing a registration process for use in an internal network. I am having issues with the security aspect of the 'app'. How could I stop people going to the last page of the registration without filling out the first pages of it or alternately skipping back to change the previous sections?

I have been using a systems of ifs;

if($_SESSION['p'] !== $thisPage) { header.... }

Any ideas?

Byron Williams

MarkR

The most obvious approach is for the application to decide which page to display rather than the user.

Don't put that info in the URL, rather just display the page appropriate to the stage they're on.

Each section would have to have been flagged passed (in either the DB or session) to allow them to move on.

This would also be helpful as your form could post back to itself, allowing you to (more) easily highlight errors on the form.

Mark