Security bug?

Fawaz,

1. When I use the security users can see and edit other users data

What exactly would you like to prevent here ?

2. I am using the security users can only see and edit their own data

No data will be displayed and no data will be written to the database in this case.

So there is no vulnerability here.

Fawaz,

Alexey,

For 1. When I use the security users can see and edit other users data
If someone changes the URL from profile_edit.php?editid1=x to profile_edit.php?editid1=y then he will be able to edit profile y.
How do I prevent that? I don't want anyone to change the url and retrive the data.

Thanks

Fawaz

Fawaz,

I don't want anyone to change the url and retrive the data

You can not prohibit users modifying URLs.

Choose "Users can see and edit their own data" security mode to hide the data.