Re: Additional database condition in -all- queries?

Jake Janovetz
2005-12-02T16:06:49Z

christer wrote:
> There is no need to do this for all queries.
>
> Example: Every customer has some orders. Every order has some
> orderlines. The orderlines do not need to have the customer_id repated.
> By following the foreign keys orderline.order_id and order.customer_id,
> the customer is found.

Thanks.  While I agree this can be relaxed in some cases, it also needs
to be there for security purposes, doesn''t it?  In particular, I
don''t
want people writing their own URLs and gaining access to another
customers'' data.

This -should- be taken care of by the account system which I have in
place, but it''s difficult to consider all possible ways people can
infiltrate a system.  I''m trying to wrap my head around that with this
question.