0

We would like a user (student) to have a student ID that they can quote and this stays with them as they learn with us.

When they create a profile, by registering on our site is it possible to provide the unique user_ID that is created to them in their confirmation, plus have it visible to them on their own profile page.

Similarly, users who have a role as a teacher we would like their ID to be searchable on the front end to verify them. So as well as searching a name in a member directory for example, their user_id could be a field that is searchable. Only people who have a particular role assigned would be searchable.

Is this possible. Thank you.

Improve this question

1 Answer 1

Reset to default
0

This will give the user id of the currently logged in user:

$current_user_id = get_current_user_id();

User IDs are assigned sequentially (normally) when a user is created in WP admin (or by a process that creates the user ID programmatically).

But be aware that the user ID can be abused. For instance, one could query your site looking for a user ID of '1' - which is usually the admin user. That could be information that could be used inappropriately.

And there are easy ways to enumerate all user IDs, by sequentially querying the site for user IDs. Another piece of information that could be used inappropriately (and has been to help attack sites).

So, whatever process you use to assign a user ID should take into account the possibility of abusing that information. Sequential user IDs can be a pathway to an attack on the site.

It might be better to use the user email address as an indentifier. With appropriate precautions to keeping that information secure.

Improve this answer
3
  • That's helpful to know, thank you Rick.
    – AB_100
    Commented Jan 19, 2023 at 10:34
  • If the answer is what you are looking for, it is helpful to others to mark the answer as correct. If it provides useful information, you can 'vote up' it. (That's how things work here.)
    – Rick Hellewell
    Commented Jan 19, 2023 at 21:40
  • There's a WordPress function called _doing_it_wrong() that "Fires when the given function is being used incorrectly." While we aren't talking about calling a function in this situation... what you are asking at face value is _doing_it_completely_wrong() My answer is : don't just consider not doing... do NOT do that. yes, it's a potential security breach, but you are also setting yourself up for programmatic problems and creating pitfalls for logical processes... imagine "Please enter your 1-16 digit ID#" (assuming user_ID is an integer ID in the MySQL database and not arbitrarily assigned)
    – aequalsb
    Commented Jan 21, 2023 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.