Thanks, that was very well

drew22299 — Fri, 28 Mar 2008 15:43:19 +0000

Thanks, that was very well explained. I have a user table and a messages table with the following fields

messageid, userto, userfrom, date, subject, message

I'll try the query you suggested

I don't think this really

teammatt3 — Fri, 28 Mar 2008 15:32:09 +0000

I don't think this really has to do with sessions much. It has to do with how you structure your queries and how your tables are setup.

You need a query that SELECTs the messages based on the user's ID (because they don't have the ability to change that). This might work if a message can only be sent to one person.

"SELECT * FROM Message WHERE To = $userID AND MessageID = $messageID"

So if Hannah Hacker goes in his address bar and changes the MessageID, if that message ID exists *BUT* it wasn't addressed to her (the To field), no rows are returned.

Do you have two tables to handle messages? Something like Message and User2Message? You'd use an INNER JOIN to connect them and do the same type of thing.