用户数据库结构

Question

I'm running a basic website with some user accounts (no cookies, php session system.). I'd like to store some data generated by the user only visible for themselves.

For the moment I store the data from all users in one table, with an extra column for identifying (this is an input from php session user-id). (We are talking about max. 50-100 keys per user).

On data request I have an extra parameter (AND "user-id"=x) in the mysql query.

1. Is this a safe (there is no sensitive data on the site, but the accounts have to be private anyway) way of storing data?

2. Are there better ways to handle this? (I read about separate databases etc.) and if so, how?

thx,

M.

Answer 1

Is this a safe (there is no sensitive data on the site, but the accounts have to be private anyway) way of storing data?

There is nothing wrong in having the user-id=x in your mysql query to get the data from the table. But make sure you are not directly reading this value from your query string and appending to the mysql query without doing proper sanitization and cleaning. Otherwise you will be a vicitm of SQL injection.

Are there better ways to handle this? (I read about separate databases etc.) and if so, how?

I don't see any reasons to have seperate database to handle this. You can use your current database. If needed, you may create additional tables for this. I am not sure what is your db schema and entity relations. So i am not in a position to tell you how to do that. Look into your tables and make sure it is normalized.

If you want the data stored to be seen only by that particular user, You probably want to check in whether the current logged in user id ( get from the session variable ?) is same as of the userId of the db record. May be you can compare with the "CreatedById" field value if you have one.

I believe this link is a must read if "SQL injection" is a new term for you. http://www.unixwiz.net/techtips/sql-injection.html