views:

286

answers:

1

Ok, would this work?

When a user logins a session variable is created. Then using the session variable I am able to put into a hidden field the correct user's ID number. The hidden field is in a form that allows the user to add comments. So from the hidden field the user ID is added to the 'comments' table from the 'users' table?

Thanks for the help. If it won't work, is there a reason why? What should I do to make it work if it won't?

Also, I'm using ColdFusion, MYSQL and Dreamweaver if it makes any difference. cheers.

+1  A: 

You don't need hidden field of the user id on the form.

When the user send in a form, just access the session scope directly.

so.. when user logged in, store userid in SESSION.userid

when the form posted, get SESSION.userID and FORM.fieldXXX and go from there.

Henry
OK, great thanks!
Bridget
Moreover, you should *never* put something like the userid somewhere a user can edit it -- form, cookie, etc. Keeping it in the session scope renders it uneditable, but as soon as you rely on the client to return it correctly, you're asking for impersonations.
Ben Doom