[RESOLVED] Edit Record

[teamfox20]

What is the best way to edit a record in my PHP without passing the $id in the url.

I have a multi user database and i dont want one user to be able to change the $id in the url so they can access records that do not belong to them.

[bretticus]

Store his or her userid in a session var (when the user successfully autheticates for example.) If the userid in the record doesn't match the userid in the session var, don't allow access to that record. Also, you could put a GUID in each record insert and use it as the primary key or just indexed in addition to a primary key. Then refer to the record in the URL with the corresponding GUID making it almost impossible to guess.

[teamfox20]

How can i go about doing the session var check and the userid check.

[liquorvicar]

You'll need a field in your table to store the ID of the user to whom each record belongs. Then when you're retrieving the row data for editing and

" AND user_id=".$_SESSION['user_id']

to your query. It will only return rows that are "authorised.

[teamfox20]

I have actually been playing around with that but all i get is errors.

$colname_Recordset1 = "1";
if (isset($HTTP_SESSION_VARS['customers_id'])) {
  $colname_Recordset1 = (get_magic_quotes_gpc()) ? $HTTP_SESSION_VARS['customers_id'] : addslashes($HTTP_SESSION_VARS['customers_id']);
}
mysql_select_db($database_my_conn, $my_conn);
$query_Recordset1 = sprintf[COLOR=Red]("SELECT * FROM card_schedule WHERE id = '$id' AND customers_id=.$_SESSION['customers_id'] LIMIT 1", $colname_Recordset1);[/COLOR]
$Recordset1 = mysql_query($query_Recordset1, $my_conn) or die(mysql_error());
$row_Recordset1 = mysql_fetch_assoc($Recordset1);
$totalRows_Recordset1 = mysql_num_rows($Recordset1);

[bretticus]

Read up a bit on sprintf as your syntax was wrong for one. The correct syntax would be:

$query_Recordset1 = sprintf("SELECT * FROM card_schedule WHERE id = '%s' AND customers_id=%s LIMIT 1", $id, $_SESSION['customers_id']);

Also, just saying, "I get errors." without posting errors on these forums is a bit of a faux pax. If you really need the help, you need to post the important details. Could you resolve a vague error without an error message?

[teamfox20]

Sorry. I intended to post the error but must of gotten distracted.

I made the suggested corrections but get the error:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1

[bretticus]

what is the output of

echo $query_Recordset1;

[teamfox20]

using the code

$query_Recordset1 = sprintf("SELECT * FROM card_schedule WHERE id = '%s' AND customers_id=%s LIMIT 1", $id, $_SESSION['customers_id']); 

All i get is this error and it will not show the echo :
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'LIMIT 1' at line 1

[bretticus]

right, you need to echo it before trying to actually use it. In fact, comment that all ou for now...

//$Recordset1 = mysql_query($query_Recordset1, $my_conn) or die(mysql_error());
//$row_Recordset1 = mysql_fetch_assoc($Recordset1);
//$totalRows_Recordset1 = mysql_num_rows($Recordset1); 

[teamfox20]

If i comment all that out. it does not echo anything.

$colname_Recordset1 = "1";
if (isset($HTTP_SESSION_VARS['customers_id'])) {
  $colname_Recordset1 = (get_magic_quotes_gpc()) ? $HTTP_SESSION_VARS['customers_id'] : addslashes($HTTP_SESSION_VARS['customers_id']);
}
echo $query_Recordset1;
//mysql_select_db($database_my_conn, $my_conn);
//$query_Recordset1 = sprintf("SELECT * FROM card_schedule WHERE id = '%s' AND customers_id=%s LIMIT 1", $id, $_SESSION['customers_id']);
//$Recordset1 = mysql_query($query_Recordset1, $my_conn) or die(mysql_error());
//$row_Recordset1 = mysql_fetch_assoc($Recordset1);
//$totalRows_Recordset1 = mysql_num_rows($Recordset1);
?>

[bretticus]

ummmm....you commented the variable assignment also.

just comment the last three lines like I showed you.

mysql_select_db($database_my_conn, $my_conn);
$query_Recordset1 = sprintf("SELECT * FROM card_schedule WHERE id = '%s' AND customers_id=%s LIMIT 1", $id, $_SESSION['customers_id']);
echo $query_Recordset1;

[teamfox20]

SELECT * FROM card_schedule WHERE id = '12' AND customers_id= LIMIT 1
Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /home/r365/public_html/edit_contact.php:75) in /home/r365/public_html/includes/functions/sessions.php on line 66

[bretticus]

teamfox20 wrote:

SELECT * FROM card_schedule WHERE id = '12' AND customers_id= LIMIT 1

forgetting all the header mumbo jumbo, notice how $_SESSION['customers_id'] has no value.

customers_id=

. You need to fix that. How are you setting it in the first place?

[teamfox20]

oh god....i figured it out...i had a include file in the wrong place.

now i get....SELECT * FROM card_schedule WHERE id = '12' AND customers_id=11 LIMIT 1

[bretticus]

yaaaaa!!!

[teamfox20]

How do I display an error if the user changes id=11 to something that does not belong to them?

for example...https://www.remembered365.com/edit_contact.php?id=11 to
https://www.remembered365.com/edit_contact.php?id=12

[bretticus]

teamfox20 wrote:

How do I display an error if the user changes id=11 to something that does not belong to them?

for example...https://www.remembered365.com/edit_contact.php?id=11 to
https://www.remembered365.com/edit_contact.php?id=12

from

$totalRows_Recordset1 = mysql_num_rows($Recordset1);

$totalRows_Recordset1 will be 0 if the numbers don't match. Just use an if statement.

[teamfox20]

I really appriciate ALLLLLLLL your help!!!!

The funny thing is if i change the ID to 11 or 12 which is registered to user 9 it will display...

if i change it to 13 or 14 which is registered to user 11 it will disply:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1

[bretticus]

well, you have to check for the existence of the $_SESSION variable. In fact, your security include file (I presume) should redirect to the login page if that session variable is not set anyway. I got an SQL error when I clicked on your link. Since there's no way for me to get a session var (I didn't log in), and since I know what code you're using, I can safely say the SQL query broke again because of a missing value. You can wrap single/double quotes around it (MySQL doesn't care.) But the debuggig process is the same: if you get a SQL syntax error, ocho out the query and have a look. You'll egt it, just stick with it.