Hello All,

I have created a web report where user types his/her ID, a page checks and if there is a match the report is displayed. The problem I have is when the report is generated the URL address is something like this: http://companyname/reports/reports.asp?name=123. With this, when the user changes the 123 to say 124, it displays report for the user with ID 124. How do I stop this from happening? I posted this topic before and got one response but that didn't help. Thanks!

use POST instead of GET so that the '123' is posted to your report and no across the address bar like GET does.

Chris

Why don't you do the checking in the page that actually displays the reports. That way if they change the name it won't let them view it. I don't think changing to POST will help much - someone could easily set up an HTML form that POSTs 124 to your address.

Thanks, pgtips, I did the check at the report page and it worked.