如何使用 PHP 会话并实施基本 ACL？
我一直在谷歌搜索会话变量。据我了解，我可以使用它们来捕获用户名和其他数据等内容。
我希望能够使用这些数据来存储最后一个更改特定字段记录的人的用户名。此外，我希望能够限制特定用户在网站上看到的内容。例如，如果用户生成工作订单，我希望该用户只能看到他/她创建的工作订单，而不能看到其他人的工作订单。
我对这一切都很陌生，我什至没有足够的理解来编写一些您可能会为我纠正的代码。如何将存储在会话变量中的数据作为 $_GET 或 $_POST 发送？如果我有这种格式，我可以在查询中使用它（我认为）。
- 我有一个名为“work_orders”的表，其中有一个名为“updated_by”的字段。我希望能够存储最后更新记录的人的 ID。
- 我还想为工作订单添加权限，以便用户只能查看特定用户创建的记录。
这是我在第一年网页设计课程中进行的一个项目。班上有一些学生，他们认为看到自己对他人的工作造成如此大的损害是很有趣的。这就是我希望能够限制他们只能访问他们生成的工单的原因。
I have been Googling session variables. As I understand it, I can use them to capture such things as username and other data.
I would like to be able to use the data in order to store the username of the last person to change the record of a particular field. Additionally, I would like to be able to limit what a particular user sees on the site. For instance, if a user generates a work order I would like that user to be limited to seeing only the work orders he/she creates and no one else's.
I'm very new at all of this and I don't have a enough understanding to even write some code you might correct for me. How can I send the data stored in the session variable as $_GET or $_POST? If I have it in that format I can use it in the query (I think).
- I have a table called "work_orders" with a field called "updated_by". I would like to be able to store the ID of the last person who updated the record.
- I would also like to add privileges to the work orders so that users can only view records created by particular users.
This is a project I undertook in my first year web design class. In the class are some students who think it is funny to see how much damage they can do to the work of others. This is the reason I would like to be able to limit them to accessing only the work orders they generate.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您可能想首先阅读或观看视频教程，这将帮助您更好地了解如何以及何时使用会话变量。您在会话中存储的数据不会永远保留，因此您需要将大部分信息存储在数据库中。
大多数人都会这样做：用户登录应用程序后，您将他们的用户 ID 放入会话中。这样，你就知道他们是谁了。服务器使用 cookie 来实现这一神奇效果，当用户关闭浏览器时，服务器将忘记他们是谁，并且会话数据将丢失。因此，在此示例中，会话只是跟踪用户是谁。
要存储有关谁最后编辑字段的信息，您可能需要使用数据库来存储该信息。将该信息存储在会话变量中是没有用的。
You might want to start by reading or watching a video tutorial that will help you better understand how and when to use session variables. The data that you store in the session won't stick around forever, so you will need to store most information in a database.
Here is what most people do: Once the user signs into the application, you put their user id into the session. This way, you know who they are. The server uses a cookie to make this bit of magic happen and when the user closes their browser, the server will forget who they are and the session data will be lost. So, in this example, the session is just keeping track of who the user is.
To store information about who last edited a field, you will probably want to use a database to store that information. There is no use in storing that information in a session variable.
你似乎在这里混淆了你的问题。
首先，你的数据库在哪里？如果是 - 例如 - MySQl，那么您需要向工作订单表（以及其他表）添加一个额外的列。就我个人而言，我喜欢添加时间戳列，用于审计海豚）。
与 GET 相比，我更喜欢 POST，因为 1）它可以保存更多数据，2）用户不容易篡改。
因此，如果您有一个表单，其中的输入字段声明为
“名称”：
参阅http://www.w3schools.com/html/html_forms.asp）
（请 可以访问
$_POST['user_name']例如$sql = 'INSERT INTO work_order_table (user_name, ... <其他列名>) VALUES($_POST['user_name'], .. <其他值>)我建议您找一本好书（足够便宜的第二本）或在线教程，然后按照自己的方式完成。
如果我错过了什么或者有什么不清楚的地方，请告诉我。祝你好运！
既然您担心学校的孩子会破坏您的数据库
1）谷歌如何使MySql更安全
2) 提示这将涉及准备好的陈述
3）使用POST，而不是get，这样你就有像
http://192.1.68.1.1/application这样的url，而不是http://192.1.68.1.1/application？ user=smith诱使用户乱搞 URl“只是为了看看会发生什么”（可能比学校级别的 SQL 注入更危险，但是......你永远不知道4) 访问一些库，例如 O'Reilly 的 PHP & 24小时内为白痴初学者打造MySql for Dummies - 或者找个大神在线教程
5) “我希望能够限制该特定用户仅查看他们生成的工作订单”请阅读 SQL SELECT 中的 WHERE
6) 更改 MySql root 密码 - 甚至添加具有类似 root 访问权限的新用户，然后删除 root
7) 确保没有学生可以访问服务器，以免他们查看 PHP 并看到您的 MySql 用户和数据库。密码
You seem to be mixing your questions here.
Firstly, where is your database? If it were - for instance - MySQl, then you need to add an extra column to the work order table (and others. Personally, I like to add timestamp column to, for auditing porpoises) .
I prefer POST over GET because 1) it can hold more data and 2) it's not so easy for the user to tamper with.
So, if you have a form with an input field declared
Name:
(see http://www.w3schools.com/html/html_forms.asp)
You can access
$_POST['user_name']e.g$sql = 'INSERT INTO work_order_table (user_name, ... <other column names>) VALUES($_POST['user_name'], .. <other values>)I woudl recommend you to get a good book (cheap enough second had) or online tutorial and work your way through.
Pleas let me know if I missed anything or if anything is not clear. Good luck!
Since you are concerend about school kids screwing with your datbase
1) google for how to make MySql more secure
2) hint this will involve prepared staments
3) use POST, rather than get, so that you have urls like
http://192.1.68.1.1/applicationrather thanhttp://192.1.68.1.1/application?user=smithwhich tempt users to muck around with the URl "just to see what happens" (probably more of a danger than SQL injection at school level, but ... you never know4) hit the libbrary for soemthign like O'Reilly's PHP & MySql for Dummies in 24 hours for complete idiot beginners - or find a god online tutorial
5) "I would like to be able to limit that particular user to viewing only the work orders they generated" READ up on WHERE in SQL SELECT
6) change the MySql root password - or even add anew user with root-like access then delete root
7) make sure that no student has acess to the server, lest they look at the PHP and see your MySql user & password