# Access to database rows

**URL:** <https://community.dreamfactory.com/t/access-to-database-rows/1161>\
**Category:** Authentication & Security\
**Created:** [June 4, 2015, 8:09pm UTC](https://community.dreamfactory.com/t/access-to-database-rows/1161 "2015-06-04T20:09:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jwerfel](https://avatars.discourse-cdn.com/v4/letter/j/e56c9b/32.png) [@jwerfel](https://community.dreamfactory.com/u/jwerfel)\
**Post date:** [June 4, 2015, 8:09pm UTC](https://community.dreamfactory.com/t/access-to-database-rows/1161/1 "2015-06-04T20:09:07Z")

</div>

I have created a database through DreamFactory and I have created a simple UI that allows users to add rows to the database. Through my UI I would like to then be able to show entries the user has added. I know how to do all of this but my concern is, how do I prevent user A from viewing user B’s data? The query from the UI to filter the database results will include the logged in user ID, but anyone could easily see that raw request, change the user ID and be able to view another user ID. Is there some way on the server to restrict the rows in the database a user has access to?

Thank you

---

<div class="post-metadata">

**Author:** ![jeffreystables](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.dreamfactory.com/jeffreystables/32/173_2.png) [@jeffreystables](https://community.dreamfactory.com/u/jeffreystables)\
**Post date:** [June 4, 2015, 8:23pm UTC](https://community.dreamfactory.com/t/access-to-database-rows/1161/2 "2015-06-04T20:23:09Z")

</div>

This is easily accomplished with server-side scripting. Here is a thread that covered this topic thoroughly:

> [@How would I manage (in the DSP), every user has his/her own Todo-List?](https://community.dreamfactory.com/t/how-would-i-manage-in-the-dsp-every-user-has-his-her-own-todo-list/181):
>
> subject sais it all: let’s say, I want every user to have his/her own todo list, which is created when the user registers (or confirms his/her registration). How would I do this in the DSP? thx

And here is another thread with some more details:

> [@How to give fine grained method permission to a DSP service accessing a remote REST web service](https://community.dreamfactory.com/t/how-to-give-fine-grained-method-permission-to-a-dsp-service-accessing-a-remote-rest-web-service/428):
>
> Hello everybody, I managed to set up a new DSP service that in turn accesses a remote REST web service. The DSP service is comprised of the following entities /users - Representing all users in the system /users/{user\_id} - Representing a specific user in the system /users/{user\_id}/reservations - Representing all reservations of a specific user in the system /users/{user\_id}/reservations/{reservation\_id) - Representing a specific reservations of a specific user in the system Now I was …

And here are some references from our documentation that give you a technical basis for the details:

- [Common Features of Database Services](https://github.com/dreamfactorysoftware/dsp-core/wiki/Database-Services#common-features)
- [Server-Side Filtering by Record Owner](https://github.com/dreamfactorysoftware/dsp-core/wiki/Server-Side-Filters#filter-by-record-owner)
- [Server-Side Scripting](https://github.com/dreamfactorysoftware/dsp-core/wiki/Server-Side-Scripting)
- [Accessing the API from Server-Side Scripts](https://github.com/dreamfactorysoftware/dsp-core/wiki/API-Access-via-Scripts)