Re: Passing URL parameters, how to hide
| From: | Stuart Felenstein | Date: | Tue, 21 Sep 2004 15:23:51 +0000 |
| Subject: | Re: Passing URL parameters, how to hide | ||
| References: | 1 | Groups: | php.db |
| Request: | Send a blank email to php-db+get-36310@lists.php.net to get a copy of this message | ||
Nope, can't get to any other record. One would have
to match both userid and recordID to get a hit.
Perhaps now I should put this into a form and send it
via hidden fields , for another layer of protection.
Stuart
--- John Holmes <holmes072000@charter.net> wrote:
> From: "Stuart Felenstein" <stuart4m@yahoo.com>
>
> > So what I did was this statement: SELECT * FROM
> Table
> > WHERE RecordID = blue and UserID = red
> > blue is the variable for the recordID
> > red is the variable for the userID
> >
> > So now when I change either of those variables in
> URL
> > no record is returned.
> >
> > Did I finally get this right ?
>
> You tell us; can you get to any other record? Sounds
> like you're heading in
> the right direction, though...
>
> ---John Holmes...
>
>