thank you for that, i should go back and change all other coding like that to be on the safe side.

-----

so its ok to have users information displayed to them based on their username like i've done it?

what i was also thinking was if i have a file called img.php and this file would display the user his image based on the id that was passed to another page meaning that

img.php?id=$row['id']

to have the img.php check to see if user who is asking to see the file actually does have the image and doesnt try to hack to see another persons image.

so he cant go and type img.php?id=5 or id=4 in the url

get what im saying?

i'll also use url rewrite once i understand the regex part of it :p

__________________
no signature set