Session Question
| From: | Pushpinder Singh Garcha | Date: | Wed, 21 May 2003 18:24:59 +0000 |
| Subject: | Session Question | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-148430@lists.php.net to get a copy of this message | ||
Hello,
I am making use of sessions in my site. After a user logs in successfully I register a session using the 'login' value and allow such a user access to protected ares of the site. During the next phase of the design, I want to be able to create protected pages for "Advanced" users. These "Advanced" users have the same privileges as normal users but also have additional access rights to the site.
Each advanced user has a customized page and only he should be able to have access to his page. My idea is to compare the session name with the login of the advanced user. If the 2 match , then display the page to the user else prevent access to the page. Please advise how secure would such a scheme be?
Thanks in advance,
--Pushpinder