Question

i have a system with a login. Then, the user made the login and he have access to private stuff (personal data).

i need to recognize what user made the login to get his stuff. so, i need something like this: $nameUser=$_SESSION['u_name'] correct? then i can do the queries like that :

Select photo*from tablePhotos where name= $nameUser.

The code that i have is appropriated, or it has problems of Security?
It is indicated generate a session_id for each session?makes sense? what is the “rule”?

I don’t have much experience with sessions…

 <?php
    session_start();

    if(empty($_SESSION['u_name']))
    header("Location:index.php");   

    if(isset($_GET['logout'])) {
        session_destroy();
        header("Location:emprego.php");
    }

    $name = $_SESSION['u_name'];
    echo $name ;

    echo "<a href='secure.php?logout'><b>Logout<b></a>";

    ?>

Answer 1

As long as you always sanitize your data and use queries like

"Select * from tablePhotos where name= '" . mysql_real_escape_string($nameUser) . "'"

everything is fine