If i was doing this, I would use a form.
Passing variable's to the URL is problematic and open to abuse. By changing the URL at the top, people would be able to see others information.
You can protect this obviously, by employing sessions, and when they log in, their session ID is inserted into the db and tied to their account. You would have to code the edit page to first check the session, then run a mysql statement to confirm that the session ID ties to that account, if it does, render the rest of the page. If it doesn't redirect them to the login page again and kill their session using session_destroy()
Form:
By using a form, you've locked down the ability to change the ID of the page that people will be editing. Using the following code would be a very simple implementation of this.
[php]
<form action="edituser.php" method="post" enctype="multipart/form-data" name="edit" id="form">
<input name="id" type="hidden" value="<?php echo "$uID"; ?>">
<input type="submit" value="Edit" name="submit">
[/php] You would have to deploy an SQL statement at the top of this page to get the $uID, again, I'd use sessions and insert the sessionID into the user table at point of login.
Your edit page would then use the following code to get the information
[php]
<?
//insert session checker here and use header to redirect
// Get userID
$user = $_POST['uID'];
// get user detals mysql here
// select user,name from table where user = $user
?>
[/php]
HTH
Last edited by cpickering; Jan 10th, 2007 at 10:03 am.
Reputation Points: 36
Solved Threads: 1
Junior Poster in Training
Offline 60 posts
since Jan 2007