[jamoss]

Yes, it only passes the username through, it does not check your authentication tokens (unless you add each user as a chat user through your chat admin, but that is a nightmare if you have a large userbase like we do).

SO, this is why you must remove the [LOGOUT] button-- or else they can logout and then choose their own username for chat.

Because we have paid subscribers, I also put in an authentication check at the beginning of the chat php file, just to make sure the user is subscribed and their account is not expired.

Jennifer.