Skip to main content
S
Svnelvn
Participant
July 26, 2010
Question

Restrict access of user profile page to user only

  • July 26, 2010
  • 2 replies
  • 2104 views

Hello,

RIght now I have made a dynamic user profile link eg. www.website.com/profile.php?id=123 which I want access only to the user with id 123, so only 123 can view and update his profile information. (and www.website.com/profile.php?id=456 can only be accessed and edited by user with id 456)

Dreamweaver's restrict access to page function only restricts page to log in, so as long as you are logged in you can view and edit any user's profile.

What do I need to do to my profile.php to restrict the page to specific logged in user?

Thanks!

Regards,

Svnelvn

This topic has been closed for replies.

2 replies

Lon_Winters
Lon_Winters
Inspiring
July 26, 2010

Think of how the user is getting to that page - is it through a "My Profile" type link, or is it from a list of users?

If it's a My Profile link, then the profile being displayed is already based on that User ID and you could protect it with Logon only. If it's from a list of users, then you may want to rethink why you're showing a list of users where each user can only get to his own profile page - unless there's a "public" portion of a user's profile.

B
bregent
Participating Frequently
July 26, 2010

>If it's a My Profile link, then the profile

>being displayed is already  based on

>that User ID and you could protect it

>with Logon only

Lon, I would worry about a valid user logging on and then switching to another user's profile by editing the querystring. To prevent this, I would not allow a profile to be retrieved from a querystring. I think the safest is to use the userid stored in the session to retrieve and edit any personal data.

B
bregent
Participating Frequently
July 26, 2010

You need to test that the userid being retrieved in the query matches the logged in user id. If it does not, redirect the user.

Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices