遍历MySQL结果并将值保存到$ _SESSION

Question

I am trying to store each column name in my database into its own $_SESSION. For example, say my column names are column_one, column_two, column_three, column_four, and column_five. I want these to be stored in a $_SESSION like $_SESSION['column_one'], $_SESSION['column_two'], etc. I am trying to do this in a loop but I have not been successful. How would I setup the loop to achieve this?

$query = "SELECT * FROM table WHERE user_id = $id";
$result = mysqli_query($dbc, $query);
$num = mysqli_num_rows($result);

if ($num == 1) {

    //User was found
    while($row = mysqli_fetch_array($result, MYSQLI_BOTH)) {
        $_SESSION['user_id'] = $row['user_id'];
    }

}

Answer 1

Could you try this:

$id = mysqli_real_escape_string($dbc,$id);
$query = "SELECT * FROM table WHERE user_id = $id";
$result = mysqli_query($dbc, $query);
$num= mysqli_num_rows(result);
if ($num == 1) {
    $row = mysqli_fetch_assoc($result);
    $_SESSION['UserData'] = $row;
}else{
//handle error or user not found
}

echo '<pre>';
print_r($_SESSION['UserData']);
echo '</pre>';

You don't have necessity of use while or another loop, so is just one row

Answer 2

Something like this should work:

while($row = mysqli_fetch_array($result, MYSQLI_ASSOC)) {
    foreach($row as $column => $value) {
        $_SESSION[$column] = $value;
    }
}

Extra advice for safeguarding against SQL injection, the following two lines:

$id = mysqli_real_escape_string($dbc, $id);
$query = "SELECT * FROM table WHERE user_id = '$id'";

Update:

Thanks to EmilioGort who pointed out the missing connection parameter in mysqli_real_escape_string . See mysqli_real_escape_string docs.

Answer 3

While the other answers proposed a way to do, I'd strongly propose to not do this at all. Why?

First of all $row contains all details of the user in a well defined array form. It is generally good to keep this structure well prepared.

More important: Flattening $row might force name clashes like so:

Suppose $row has a property userName and somewhere else in your application you eventually set

$_SESSION[ 'userName' ] = $newUserName;

The new assignment to $_SESSION[ 'userName' ] might unintentionally change the property saved during the login process.

You might argue "Right now, my code doesn't use userName in $_SESSION '. Right! Unfortunately, you might use just this name for something else many month later on...

A better solution

I'd save the user detail like this:

$_SESSION[ 'sys$userDetails' ] = $row;

Imagine the prefix sys$ as being an indicator for framework generated properties of your session.

Thus, business logic related session data shouldn't have the sys$ prefix.