Assign a session ID that is completely random and never re-used. Store it
in a file with the necessary information to identify the current signed on
customer. Even if they see it, it means nothing to them or any one else.
When they logoff, delete the record and have an activity time stamp that can
be used to expire the record and purge them on a regular basis.
Chris Bipes
-----Original Message-----
I had originally thought about that. But my concern is that someone will
look at the HTML source and see the hidden field and then be able to modify
information. My site will be used for my distributors to have access to
their data. open order, net price, etc. I do not want someone to be able
to change the customer number in the hidden field and then replacing the
variables on the address bar and access a different customers information.
I would hope this would not happen. But If I have thought of it then
someone else has also.
I just want to protect my customers/distributors.
I might go this route to initially get the site running until I can find an
alternate solution
Scott Swaim
