Re: User Authentication Continued....

I guess you would either need to make the vars global or else keep redeclaring them. Obviously, redeclaring them in each function $var=$_GET["whatever"] is technically the more secure method. Kris Jeff McKeon wrote:

Ok, I've got the user authentication thing down and now I'm continuing to build my trouble ticket tracking system. So from a "customer profile" page there is a link to "Open Ticket" which brings up a page to open a trouble ticket. [html code] HREF=./open_ticket.php?custid=$custid&custname=$custname [html code] The user is validated for permissions and timeout based on the $_SESSION variables established before the "open ticket"" page is loaded. I then have a form that they fill in with the minimum info to create a new ticket. Some info is passed to the open ticket page from the customer profile page via a GET method and enterred into hidden form fields. [html code] HREF=./open_ticket.php?custid=$custid&custname=$custname [html code] On the "open ticket" page I have 2 functions, the first is a form for entering in the ticket info, the second is a function to take the information and update the database with it when the form is submitted, then reload the page with a display of the ticket info. The problem I'm having is with the $_GET variables. I guess I'm not declaring them correctly. Do I need to set them as soon as the page loads, and outside of any functions like so.. [code start] $custid = $_GET['custid']; $custname = $_GET['custname']; [code end] Or do I need to declare them in each funtion? [code start] Function blah(){ global $custname, $custid; $custid = $_GET['custid']; $custname = $_GET['custname']; DO SOME STUFF.... } Function foo(){ global $custname, $custid; $custid = $_GET['custid']; $custname = $_GET['custname']; DO SOME STUFF.... } [code end] Or am I way off and there is another way of doing it? Also I've noticed that when I do an mysql_query("select name from foo where name='$somevariable'") I cannot use $_GET['somevariable'] or $_POST['somevariable'] in the sql string, I find I need to do a $name = $_GET['somevariable'] first and then use $name. Why is this? Thanks, Jeff