[RESOLVED] Prevent Altering of MySQL Record

[rsmith]

Hey all, is there any way to lock a record in a MySQL DB so that it cannot be altered aside from checking the id that is being passed to the script that will update information? Right now I just have my scripts check to see if a specific id is being passed, if so, it redirects and stops processing.

[rulian]

I dont think mysql has individual row locking abilities, it does have table locking but it does not serve the purpose you are looking for. Row locking in mysql is done to prevent different users from updating the same row at the same time.
Depending on what you are using it for, you can give your users different levels of access to different parts of your site to limit who and what can be updated.

Otherwise, it alls comes down to your scripts to make sure you are only editing the rows you want.
I could suggest having a "editable" field in your db set to true or false so you can keep track if each row is editable or not

[rsmith]

Thanks for the response. I'm just going to go through with a fine tooth comb and make sure that there's no way to pass the id of a protected row. Thanks again!

[rulian]

how are you passing the variables, and where does it come from?

[rsmith]

Sometimes the ID's are passed through $POST from a form; but in some instances the ID is passed as a variable in a URL and retrieved using $GET to use in a query.

[rulian]

how do you tell the difference between an ID you can or cannot edit?