Re: [PHP] User Authentication Continued....

Kris Yates Fri, 03 Oct 2003 12:16:01 -0700

I guess you would either need to make the vars global or else keep redeclaring them. Obviously, redeclaring them in each function $var=$_GET["whatever"] is technically the more secure method.

Kris

Jeff McKeon wrote:

Ok,

I've got the user authentication thing down and now I'm continuing to
build my trouble ticket tracking system.

So from a "customer profile" page there is a link to "Open Ticket" which brings up a page to open a trouble ticket.

[html code]
HREF=./open_ticket.php?custid=$custid&custname=$custname
[html code]

The user is validated for permissions and timeout based on the $_SESSION
variables established before the "open ticket"" page is loaded.

I then have a form that they fill in with the minimum info to create a new ticket. Some info is passed to the open ticket page from the customer profile page via a GET method and enterred into hidden form fields.

[html code]
HREF=./open_ticket.php?custid=$custid&custname=$custname
[html code]

On the "open ticket" page I have 2 functions, the first is a form for
entering in the ticket info, the second is a function to take the
information and update the database with it when the form is submitted,
then reload the page with a display of the ticket info.

The problem I'm having is with the $_GET variables.  I guess I'm not
declaring them correctly.  Do I need to set them as soon as the page
loads, and outside of any functions like so..

[code start]
$custid = $_GET['custid'];
$custname = $_GET['custname'];
[code end]

Or do I need to declare them in each funtion?

[code start]
Function blah(){
        global $custname, $custid;

        $custid = $_GET['custid'];
        $custname = $_GET['custname'];
        DO SOME STUFF....
}

Function foo(){
        global $custname, $custid;

        $custid = $_GET['custid'];
        $custname = $_GET['custname'];
        DO SOME STUFF....
}
[code end]

Or am I way off and there is another way of doing it?

Also I've noticed that when I do an mysql_query("select name from foo
where name='$somevariable'") I cannot use $_GET['somevariable'] or
$_POST['somevariable'] in the sql string, I find I need to do a $name =
$_GET['somevariable'] first and then use $name.  Why is this?

Thanks,

Jeff


--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP] User Authentication Continued....

Reply via email to