user data database structure

Question

I'm running a basic website with some user accounts (no cookies, php session system.). I'd like to store some data generated by the user only visible for themselves.

For the moment I store the data from all users in one table, with an extra column for identifying (this is an input from php session user-id). (We are talking about max. 50-100 keys per user).

On data request I have an extra parameter (AND "user-id"=x) in the mysql query.

1. Is this a safe (there is no sensitive data on the site, but the accounts have to be private anyway) way of storing data?

2. Are there better ways to handle this? (I read about separate databases etc.) and if so, how?

thx,

M.

Answer 1

Is this a safe (there is no sensitive data on the site, but the accounts have to be private anyway) way of storing data?

There is nothing wrong in having the user-id=x in your mysql query to get the data from the table. But make sure you are not directly reading this value from your query string and appending to the mysql query without doing proper sanitization and cleaning. Otherwise you will be a vicitm of SQL injection.

Are there better ways to handle this? (I read about separate databases etc.) and if so, how?

I don't see any reasons to have seperate database to handle this. You can use your current database. If needed, you may create additional tables for this. I am not sure what is your db schema and entity relations. So i am not in a position to tell you how to do that. Look into your tables and make sure it is normalized.

If you want the data stored to be seen only by that particular user, You probably want to check in whether the current logged in user id ( get from the session variable ?) is same as of the userId of the db record. May be you can compare with the "CreatedById" field value if you have one.

I believe this link is a must read if "SQL injection" is a new term for you. http://www.unixwiz.net/techtips/sql-injection.html

Answer 2

Just use the PHP $SESSION.

By using session_set_save_handler you can define your own session storage method, which could be a MySQL database for instance.

The values in a session can not be altered by the user directly (as you can with cookies). So this approach is perfectly safe, so long as you don't expose the PHPSESSID cookie value anywhere.

Answer 3

No way is 100% safe. Your method sounds very insecure but I cannot see your code. If your are cleaning the input correctly to avoid mysql injection and also there is no way for a user to specify a key of another user then you may be ok.