php - How do I prevent the ability to change the URL and see other users folders -

i have directory of folders , want prevent user named "x" whos files availiable this:reports/x/2015/04/ changing x y , seeing of folers in y. have sessions working need logged in see folders, if logged in x can see y folder changing url. here index.php.

<?php  session_start();  if(!isset($_session['username'])){    header("location:../../../../login/login.php"); }  require_once('../../../config.php'); require_once('../../../boilerplate.php');  global $smarty;  $smarty->display('general-report.tpl'); 

there's things inherently bad doing way, simplicity's sake, quick fix going checking see if username matches folder name.

so, looking @ code, this.

if ($username == $dir_name) { $smarty->display('general-report.tpl'); } else { $smarty->display('error.tpl'); }

now, why shouldn't doing way...

the logged in username shouldn't visible in url.

you don't want people start sharing usernames around via urls , have mischievous people start brute forcing way login system since know various usernames.

if me, i'd have report urls same , have logged in username determine user's reports show.

that way know it's visible person , if share url somewhere, username won't getting out wild.