Question about passing varibles

[kjspear]

Hello, I posted this in the mysql forum and was hold that it was an html question. I don't think it is. But hopefully you can help me.
Below is the code I used in a program;

mysql_select_db("mylogin",$conn) or die("Could not select database"
$sql = "select userID from logins where userID='$userID' and passID = '$passID'";

$result=mysql_query($sql);
if (mysql_num_rows($result)!=0)
{

header('location:menusm.php?userID='.$userID);

This code works fine. I authenicates the users ID and password. But I want it to pass a varible from another field, 'nickname', instead. Below is the commabd I used on the next page for now.

print $userID;

If there a way that this can be done without the user typing it in like the userID field?

Any assistance will be helpful
Thanks
KJ

 

[sleipnir214]

You're right. It's marginal whether it's an HTML question. But it for sure was not a MySQL question.


Either there is an additional complication you're not specifying, or I'm completely misunderstanding your question.

You want to pass the nickname around but you don't want to have the user type it in. Is it in the database?

If so, pass both userID and nickname in the URL. The header should look something like:

Location: fubar.php?foo=value&bar=value


I hope that your code is using something other than the userid you're passing in the URL to insure a user has logged in correctly. That method is very easily bypassed. I recommend the use of session variables.

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[kjspear]

Thanks for your assistance. Yes, I'm using userid and password to authenticate the user. This information is stored in a user login table. When the user enter the login information, his/her entery is then looked up in the mysql database. If it can't be found then an 'Invalid User/Password', message will appear.

Thanks again.

KJ

 

[sleipnir214]

But keep in mind that a user can bypass your security by simply adding &quot;?userID=<a userid>&quot; to URLs pointing into your site.



Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!