Skip to main content
A
Anonymous
March 16, 2011
Answered

Checking if values exist in the database

  • March 16, 2011
  • 1 reply
  • 1351 views

Hi,

I have problem with the values that are not in the database.

I have a form and there are two types of users:normal and the Admins.

If the user is normal user, he cannot access anyone else entries from the database. But the Admin can access all the entries.

I have done a check to so that the normal user can access only his entries:

<cfif NOT session.Admin AND process.addedBy NEQ #session.AccountID# >
             <cflocation url="main.cfm" addtoken="no">
         <cfelse>

<!--- rest of the form--->

By these, a normal useer cannot access any entries other than his own.

But  for admin, a admin can access all the entries but not the entries that  are not in the database. The query related to these form is:

<cfquery name="xx" datasource="yy">
             Select entryid, addedBy, deletedBy,processedBy
             From yy
             where entryid = #URL.entryid# AND processedBy IS NULL AND deletedBy IS NULL
                 <cfif NOT session.Admin> AND addedBy = #Session.AccountID#
                  </cfif>
Thus both users can access the  respective entries, but when the Admin enters a entryid in the URL not  existing in the database, it doesn't take the page back to main page  rather it shows the form.

Thus my question is how to avoid the values not in the database.

Thanks for the Help.

Vijayvijay77.

    This topic has been closed for replies.
    Correct answer Owainnorth

    Hi,

    Thanks for the replies. I really appreciate it.

    I have blocked normal users other than admin to access entries other than their entries.

    The  only issue I am having is if the admin changes the entryid in the URL  to something which is not valid or not in the database, the page is  redirecting to the initial form page. I just want it to redirect the  page to main page, showing all the entries. For which I have to create a  condition [I guess], to check for the values which are not valid or not  in the database.

    For example:

    http://forums.adobe.com/post!reply.jspa?message=3551690

    In  these URL if I change the message number to 3551691, and suppose I am  the admin, and the message 3551691, doesn't exist int the database, it  should redirect me to some other page, thats all I want.

    I hope my explanation is clear now. Thanks for your valuable suggestions.

    Vijayvijay77.


    Well, if you want to check it found it, why not just use RECORDCOUNT? That's kinda what it's there for.

    <cfquery name="myquery">

      SELECT stuff

    </cfquery>

    <cfif myquery.recordcount neq 1 >

      <cflocation url="/finger.cfm" />

    </cfif>

    1 reply

    D
    Dan_Bracuk
    Inspiring
    March 17, 2011

    Give the admin a better option than entering id values into a url.

    Owainnorth
    Owainnorth
    Inspiring
    March 17, 2011

    Give the admin a better option than entering id values into a url.

    Almost as if someone needs to invent...say...user interfaces?

    Dan's spot on. You should be protecting *against* people tampering with the url, not making it a required part of your system. You need some kind of page which lists your entries, with a link to each edit/view page.

    That way if someone does tamper with the url they won't be surprised if they get an error.

    A
    Anonymous
    March 17, 2011

    Hi,

    Thanks for the replies. I really appreciate it.

    I have blocked normal users other than admin to access entries other than their entries.

    The  only issue I am having is if the admin changes the entryid in the URL  to something which is not valid or not in the database, the page is  redirecting to the initial form page. I just want it to redirect the  page to main page, showing all the entries. For which I have to create a  condition [I guess], to check for the values which are not valid or not  in the database.

    For example:

    http://forums.adobe.com/post!reply.jspa?message=3551690

    In  these URL if I change the message number to 3551691, and suppose I am  the admin, and the message 3551691, doesn't exist int the database, it  should redirect me to some other page, thats all I want.

    I hope my explanation is clear now. Thanks for your valuable suggestions.

    Vijayvijay77.

    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices