Hi everyone

I know how to create a php/sql members area for a site, but the way I do this just creates members pages which are accessable to all members.

 

I want to know how to create a members area where each member would have their own area, ie. 200 members each with their own members area, which cant be access by other members.

 

This is so that I can have personal things on there for each member, which is secure and protected from other members.

 

I havent a clue how to do this so don't even know if I have posted this is in the right category but would appreciate some advice.

 

Thanks, Adey

Check the logged in user is the owner of the page?

 

Example:

 

www.yourwebsite.com/profile.php?uid=12345

For that page, you'd check that the logged in user is the user with the ID '12345'. If so, they can access the page, otherwise they should be denied access. User ID should be the primary key in the users database table - thus unique - so it can be used for this check.

 

In the most insecure, simplest form:

 

if ($_SESSION['user_id'] === $_GET['uid']) {
//Allow access
} else {
//Don't allow access
exit("Access denied.");
}

Check the logged in user is the owner of the page?

 

Example:

 

www.yourwebsite.com/profile.php?uid=12345

For that page, you'd check that the logged in user is the user with the ID '12345'. If so, they can access the page, otherwise they should be denied access. User ID should be the primary key in the users database table - thus unique - so it can be used for this check.

 

In the most insecure, simplest form:

 

if ($_SESSION['user_id'] === $_GET['uid']) {
//Allow access
} else {
//Don't allow access
exit("Access denied.");
}

 

Hi Andy, thanks for the reply.

So I presume when making the database, my SQL is still correct as it creates an ID field:

 

CREATE TABLE `users` (
`id` int(3) NOT NULL auto_increment,
`login` varchar( default NULL,
`password` varchar( default NULL,
PRIMARY KEY (`id`)
) TYPE=MyISAM AUTO_INCREMENT=3 ;

 

And then any page I want to make private I previously just used this at the top of the page:

<?
require("log.php");
?>

 

So I presume I just replace this with your:

 

if ($_SESSION['user_id'] === $_GET['uid']) {
//Allow access
} else {
//Don't allow access
exit("Access denied.");
}

 

And when doing this, does this mean I have to create the page for new user each time someone registers? I was hoping that the area could be automatically created for each new user on registration (eg when registering for ebay, facebook etc), or is that alot more complex?

 

Cheers, Adey

So I presume I just replace this with your:

 

if ($_SESSION['user_id'] === $_GET['uid']) {
//Allow access
} else {
//Don't allow access
exit("Access denied.");
}

Essentially, yes. But that code is horribly insecure as it stands.

 

And when doing this, does this mean I have to create the page for new user each time someone registers? I was hoping that the area could be automatically created for each new user on registration (eg when registering for ebay, facebook etc), or is that alot more complex?

Just make a PHP file - profile.php for example and create a template, like;

<h1><?= $username ?></h1>
<p><?= $bio ?></p>
<img src="<?= $profile_photo ?> "/>

Then just fetch the variables from the user database table (using the $_GET['uid'], for example). This means you only need to create one template/page and it can serve infinite numbers of members. You're going to need to expand your users table to give the site any real functionality.

Edited February 20, 201214 yr by andyl