Welcome Guest, Not a member yet? Register   Sign In
What's more secure than? when showing user id data
#1

So here I am playing again with CodeIgniter and I tried modifying my User controller and some private pages and I just realized that when accessing to pages like "cart.php" I can do this in order to show their cart( of current the logged in user).

Controller
PHP Code:
public function cart($id)
    {
        
        
// Check Login
        
if($this->session->userdata('user_id') != $id) {
            
// otherwise redirect to...
            
redirect('store/index');
            
 
       }

 
       // Load Library
 
       $this->load->library('cart');
    
        
$data['title'] = 'My Cart';
        
        
$data['cart'] = $this->Store_model->get_cart($id);
                    
        
        
// Load Template
        
$this->template->load('public' 'default''store/cart'$data);
                
    } 

Model:
PHP Code:
    public function get_cart($id){
 
       
        $this
->db->where('user_id'$id);
 
       
        $query 
$this->db->get('ci_cart');

        if(
$query->num_rows() > 0){
            return 
$query->result();
        } else {
            return 
false;
        }    
                
 
   

and the one I just realized which I think looks nicer to avoid having urls like(notice that I don't pass vars):
Code:
"example.com/cart/1/kirasiris"

new Controller function:
PHP Code:
public function cart()
    {
        
        
// Check Login
        
if($this->session->userdata('user_id') != $this->session->userdata('user_id')) {
            
// otherwise redirect to...
            
redirect('store/index');
            
 
       }

 
       // Load Library
 
       $this->load->library('cart');
    
        
$data['title'] = 'My Cart';
        
        
$data['cart'] = $this->Store_model->get_cart();
                    
        
        
// Load Template
        
$this->template->load('public' 'default''store/cart'$data);
                
    } 

new Model function:
PHP Code:
    public function get_cart(){
 
       
        $this
->db->where('user_id'$this->session->userdata('user_id'));
 
       
        $query 
$this->db->get('ci_cart');

        if(
$query->num_rows() > 0){
            return 
$query->result();
        } else {
            return 
false;
        }    
                
 
   

which just create a simple url like:

Code:
"example.com/cart/1/kirasiris"

So yes, I'm just wondering what is the best approach. If somebody can tell me I will be very grateful
I do Front-End development most of the time 
Reply


Messages In This Thread
What's more secure than? when showing user id data - by kirasiris - 06-22-2018, 07:10 AM



Theme © iAndrew 2016 - Forum software by © MyBB