RE: [PHP-DB] images

i'm pretty sure i read somewhere that is you use sessions php will not allow an url that contains a path to a file typed in the address bar ... may be wrong though ... and apologies once again for the shopping cart debacle yesterday. some poeple were complaining and rightly so. i received a dozen e-mails from the two guys arguing at my works address, which was nice. > -----Original Message----- > From: Ron Brogden [mailto:rb@islandnet.com] > Sent: 10 April 2001 19:57 > To: bryan; huggins@tls2000.com; db > Subject: Re: [PHP-DB] images > > > At 11:48 AM 4/10/2001 -0800, bryan wrote: > >Maybe there is a way to use .htaccess more appropriately, > >but, this site allows guest / non-members, to buy something. > >Once they buy something, they are given a username of > >email, and password (they choose). If they log back in, they > >should have access to ONLY the files they purchased. > > Easy enough. Create a table that includes allowed download > file names > attached to a given user. When the user logs in they are > given a list of > files they have permission to access. The form does not send > the path but > the row *ID* of the entry from the SQL table. When they choose the > appropriate link, the script looks it up in the database, > checks that the > user ID matches their authenticated one and if so uses > fread() to send out > the appropriate file. Just include the appropriate MIME type > header and > that's that. > > The .htaccess file should just be used to enforce access > solely via the PHP > script (i.e. deny from all). > > Cheers, > > Ron > > -------------------------------------------------------------- > --------------- > Island Net AMT Solutions Group Inc. Telephone: > 250 383-0096 > 1412 Quadra Toll Free: > 1 800 331-3055 > Victoria, B.C. Fax: > 250 383-6698 > V8W 2L1 E-Mail: > support@islandnet.com > Canada WWW: http://www.islandnet.com/ ---------------------------------------------------------------------------- - -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-db-unsubscribe@lists.php.net For additional commands, e-mail: php-db-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net