Your right. The main problem is making sure nobody can access the database and user data from their browser by just typing domain.com/databaes/data.dat and saving it. BUT at the same time allowing logged in users to edit it AND the webmaster to create new files, and delete from it. Thanks, Adam