Passing Session ID to a BIRT Parameter

TomTroll

I have a set of reports linked to an application used by multiple clients. The reports use BIRT Runtime 2.3.1 under TOMCAT 5.5.

At login the application checks user, password, etc. and sets several session variables. Example: The $_SESSION[ClientNo] variable is used by the application to filter the data each users sees and to set the column value for clientno if the user inserts new rows.

In the reports I have parameter clientnum. I understand how to pass a parameter value in the url IF hardcoded:

...****.rptdesign&clientnum=1

I first tried ...****.rptdesign&clientnum=$_SESSION[ClientNo]

That did not work. The second (and more critical) problem is a security issue.
Even if there is a proper syntax to do the above, passing the parameter in the url would allow the user could simply change the value and see another client's reports.

Example: ...****.rptdesign&clientnum=1
If user changes url to: ...****.rptdesign&clientnum=2

THEN Client 1 can see Client 2 reports.

I have a sessions table in mysql that captures the sessionid, clientid, and other information. If somone can give me an example of how to set a BIRT parameter equal to the session id, I can include the sessions table in the report dataset queries to dynamically set other report parameters.

Thanks,
Tom