PHP: Check if user can access order information -


i have written function in php check whether user can access order on web application i'm making.

it checks account owns given order id , if account isn't current session account idea make user go home page.

unfortunately not seem working, user can view order though sql query correct (i have verified through manual sql query).

is there problem in code have written?

<?php function is_accessible($document, $account) {     global $dbh;     $sth = $dbh->prepare("select account orders order_id = $document");     $sth->execute();     $result = $sth->fetchall();     if ($result[0]['0'] == $account) {     return true;     }      else {      return false;     } } ?>  <?php if (!is_accessible($_get['id'], $_session['account'])) {   header("location: /index.php"); } ?>  <?php echo $_get['id']; 10001 echo $_session['account']; 1 ?> 


Comments

Popular posts from this blog

android - MPAndroidChart - How to add Annotations or images to the chart -

javascript - Add class to another page attribute using URL id - Jquery -

firefox - Where is 'webgl.osmesalib' parameter? -