how to protect a user update from accessing other users ids

[fran7]

Hi,
I wonder if someone could point me to what it is I might need.

I am attempting to give users the ability to update their records in an access database. The records have ids.

What is to stop them from changing the id in the address bar and to view and update someone elses record from the control panel?

I am entirely new to this and just see the potential problem. Ids are not too unique.

Thanks
Richard

[jhardman]

Hi,
I wonder if someone could point me to what it is I might need.

I am attempting to give users the ability to update their records in an access database. The records have ids.

What is to stop them from changing the id in the address bar and to view and update someone elses record from the control panel?

I am entirely new to this and just see the potential problem. Ids are not too unique.

Thanks
Richard

When someone first logs in, set a session variable that is their ID number: [code=asp]session("userID ") = ID[/code]Then when they go to update, check that the numbers match:[code=asp]if session("userID ") = objRS("ID") then
'OK to update
else
response.write "Hey, this is the wrong record!"
end if[/code]

[fran7]

Thanks, Thats great.
Richard