detail page restricted to fields connected to username

I have created an asp vb site with mysql running a database in the background.

What i am trying to achieve is a detail page but restricted so users can only see work related to themselves.

I have a main page which displays jobs in the database. I have managed to restrict this page by creating a recordset which is filtered to the users username so all the jobs they see on the system are there own. The problem im having is restricted access to the detail page.

I have created a detail page which carries a unigue id in the URL (detail.asp?id=5) but the problem is if a user was to try and gain access to other information all they have to do is change the id no manually and they can see other clients jobs.

Is there away i can restrict this page so they can't access other data ?

Thanks.

Comments

Restrict access

September 2, 2005 by Carl Grint

If you have the jobs listed with the Username, which you say your list page is doing already, then simply add this to your recordset along with the ID being passed, so no matter which ID is passed, if the person is not logged in, and they are not the 'owner' of the job, then the details will not display.

You must me logged in to write a comment.