ASP.NET: Accessing other User's Profiles

One of the many improvements in ASP.NET 2.0 was the Provider based architecture, and the most under used (certainly by me) is the User Profile Provider (click here for more info). You simply define the properties you want your users to have in the web.config (see below)

<profile enabled="true" defaultProvider="MyProvider">
     <providers>
       <add name="MyProvider" connectionStringName="MyConnection"
            applicationName="/" 
            type="System.Web.Profile.SqlProfileProvider" />
     </providers>
     <properties>
       <add name="FirstName" type="string" />
       <add name="LastName" type="string" />
     </properties>
   </profile>

And .NET takes care of the rest... you can then access the profile programmatically as follows:

string firstname = Profile.FirstName;
string lastname = Profile.LastName;

Simple!

There are a couple of problems using the SqlProfileProvider, firstly the data is serialised and stored in one field in the database - making it trickier to run SQL queries on it... and the second (or so I thought until recently) is accessing other user's profile data - for example an administrator should be able to see the other user's FirstName and LastName values.

However the second issue isn't a problem at all, it is in fact possible to view/edit another user's profile with the following code:

ProfileCommon userProfile = (ProfileCommon)ProfileCommon.Create("Brad", true);
userProfile.FirstName = "Paul";
userProfile.LastName = "Bradley";
userProfile.Save();