CODEWITHSUNDEEP
phpcodeigniter
user2223224
user2223224

Reputation: 107

Logic to prevent unauthorized change in CRUD in PHP?

I'm trying to model a PHP in CRUD and am wondering what is the best method to check the user's authorization so they can only edit their own content?

For example:

abc.com/post/delete.php?id=3

How do I prevent a logged in user from editing someone else's post?

My current method is:

  1. Store User ID in session after successful logged in
  2. When requesting DELETE method, load User_ID from session
  3. Query = DELETE FROM posts WHERE user_id = $user_id AND id = 3

In this way, if a user can modify the ID parameter, they cannot manipulate the stored session variable user_id.

Is this the correct method?

Upvotes: 1

Views: 201

Answers (1)

Filippo oretti
Filippo oretti

Reputation: 49843

i suggest to use your logic but i usually store user id + access token

Access token is an hash for example sha256(username+lastname+registered_datetime); and i put it to cookie

So you'll have an extra security field , just check if auth token is ok also when user logs

Upvotes: 1

Related Questions