仅在某些用户登录时显示某些数据

Question

I'm trying to bring in data about the user from a MySQL database. I was thinking of writing a query that shows data data co-sponsoring to the users logged in.

Code

$user = new User();
$user_name = escape($user->data()->username);

$result = mysql_query("SELECT * FROM orders WHERE user_name = $user_name");

echo "<table border='1'><tr><th>My bookings</th></tr>";

while($row = mysql_fetch_array($result))
{
        echo "<tr>";
        echo "<td>" . $row['user_name']. "</td>";


echo "</tr>";
}
echo "</table>";

Here I'm getting the user name of current logged in user and trying to show only data from the database where there user_name field in the database matches the user_name of logged in user.

How could I get this to work as I think I'm not doing it correctly?

Answer 1

see if you have error in the query , and if she return results.

i think you need to wrap user name like '$user_name'

Answer 2

You have to work on your code. Once the user is authorized, save their username in a $_SESSION['uname'] for example. And using your query, search for a username= $_SESSION['uname'] and get all the related data.

Learn more: PHP MANUAL

Answer 3

If you dont use session to store the users state then other users could check orders for other users.

You should at minimum use mysql_real_escape_string() on values passed to the database query, else you will get hacked, ideally you should use parametrised query's with mysqli or PDO, what your doing is out of date.

But if your stubborn and unwilling to change ways before writing smelly code, then try something like.

<?php 
$user = new User();
$user_name = escape($user->data()->username);

$result = mysql_query("SELECT * FROM orders WHERE user_name = '".mysql_real_escape_string($user_name)."'");

echo '<table border="1"><tr><th>My bookings</th></tr>';
if(mysql_num_rows($result) > 0){
    while($row = mysql_fetch_array($result)){
        echo "<tr><td>".$row['user_name']."</td></tr>";
    }
}else{
    echo "<tr><td>No bookings</td></tr>";
}
echo "</table>";
?>

EDIT: Using the session vars from previous question :

$_SESSION['user_data']->username

<?php 
session_start();

//check session username is set 
if(!isset($_SESSION['user_data']->username))
    exit(header('Location: index.php'));

$result = mysql_query("SELECT * FROM orders WHERE user_name = '".mysql_real_escape_string($_SESSION['user_data']->username)."'");
...
...
...
?>

Hope it helps

Answer 4

user_name seems to be a varchar field. the value part should be surrounded by quotes '$user_name'

$result = mysql_query("SELECT * FROM orders WHERE user_name = '$user_name'");