如何在张贴表单时存储（和/或张贴）用户ID？

Question

I'm building a site where users create profiles and projects (startups, research, inventions, etc) and share and connect with others for a valuable exchange.

I started the site sometime ago with a friend and we've since stopped working on it together. He wrote all of the php and I did all the front end. Now I'm doing both and the concept has changed a bit. This means I'm adapting a lot of the code he has already written.

When users posts a new project, there is certain background information that needs to be posted with it. Therefore, when they create a new post I want to store their ID with it. This way when their post is displayed, it also shows the pertinent user profile information.

How do I properly store (and/or POST) their user ID as the form is POSTed?

(I apologize, I'm fairly new to PHP. Doing my best with the lingo.)

Here is some of the code (not all is needed, I know)

<?php
require_once("../includes/config.php");
require_once("../assets/classes/projects.php");
$x = new projects();

if(isset($_SESSION['username']))
{
    $_SESSION['logged_in'] = 1;
}

$dbh = config::get();

$checkCountQ = $dbh->prepare("SELECT cork_user_notes.tf_index FROM `cork_user_notes` INNER JOIN `cork_users` ON cork_user_notes.tf_index = cork_users.tf_index WHERE cork_users.tf_username = :un");
$checkCountQ->bindParam(":un", $_GET['user']);
$checkCountQ->execute();
$checkCountR = $checkCountQ->rowCount();

?>

<form action="addProjects.php" method="POST">

        <tbody>
            <tr>
                <td>
                    Enter your project name
                </td>
                <td>
                    <input type="text" name="title" placeholder="project name">
                </td>
            </tr>

            <tr>
                <td>
                     Enter your project's category
                </td>
                <td>    
                    <select name="category">
                         <option value="1">Startup</option>
                         <option value="2">Software</option>
                         <option value="3">Hardware</option>
                         <option value="4">Research</option>
                         <option value="5">Discovery</option>
                         <option value="6">Invention</option>
                    </select>
                </td>
            </tr>

Answer 1

Allowing the user to alter their user_id is not safe for your records because a user could pose as someone else. Here there is no user_id in your code, only their username which if unique, might work just as well. In order to do this efficiently it might be best to pass the value in a hidden form field in addition to a hashed field that contains a value known only to you to verify on the other side:

<?php
print "<input type=\"hidden\" name=\"uid\" value=\"".$_SESSION['username']."\">"; 
print "<input type=\"hidden\" name=\"uidh\"
value=\"".md5($_SESSION['username']."Something that only you know")."\">";
?>

On the other side you check the hash.

if (!empty($_POST['uid'])&&!empty($_POST['uidh'])
      &&$_POST['uid']==md5($_POST['uidh']."Something that only you know")){
//then they're okay
} else {
//fail spectacularly at their attempt
}

If your server is setup to handle sessions with cookies, the cookies are unsafe and can't be trusted as well.

To verify sessions you would want to hash the data with a unique key only known to you as well.

Answer 2

Why does the user ID value need to be posted from the form at all?

You have an authenticated user, you have their user's ID on the server side in some shape or fashion (maybe stored in the session or something similar). Use that when creating the project, and do not accept a user-supplied user ID.

Answer 3

Two ways to do this.

1. You session the user id when the user logs in like this

     $_SESSION['userid'] = $id; 

which you can subsequently used anywhere in the website as this case maybe when inserting

2. create an hidden field in the form to store userid

    <input type="hidden" name="id" value="<?php echo $_SESSION['userid']; ?>" /> 

you can then get it with $_POST['id'] when submit button isset.