MySQL查询和联接表

Question

I'm working something with mysql and php and I'm trying to achieve some result for learning purposes.

So what I'm trying is to make conversation messages system and I have following:

I have 2 tables, first conversation and second conversation_messages

First table conversation looks like following:

c_id, user_one, user_two

Second table conversation_messages looks like this:

m_id, text, date, created_by, status, c_id

So in messages table I set Conversation ID and when user click conversation to open it, url change to messages.php?c_id=1 or something like that... And that's fine, becouse I get c_id from url and so on.

My question is following:

Lets say I wan't to get all messages for conversation c_id = 1. How do I query trough table and get all messages for that conversation id. Also I need to query so it return results only if logged user is involved into conversation... So logged in user can see conversation messages only if he is person/user A (user_one) or user B(user_two). How do I do that and do I need to join tables. So what is the best way to do this.

So when logged in user type manually into url messages.php?c_id=3 if he is not involved into that conversation I don't want him to see it.

Sorry I'm new here and don't know how to format code properly or anything.

Thanks in advance.

Answer 1

You need to get the logged user id from a session and put into the query like that

SELECT * FROM conversation_message, conversation 
WHERE conversation.c_id = $ID_OF_CONVERSATION 
AND (user_one = $ID_LOGGED_USER OR user_two = $ID_LOGGED_USER) 
AND conversation_message.c_id =  conversation.c_id

Answer 2

In the broad strokes, if you want to add security to a certain endpoint, you need to allow or deny access after validating user input. In the example you gave, your user input is the c_id value of 3. In a simple PHP example, you could do something like this:

$user_id = $_SESSION['user_id'];
$can_access = false;
$convo_id = $_GET['c_id'];
$safe_id = mysql_real_escape_string( $convo_id );
$rli = mysql_query( "SELECT * FROM conversation WHERE c_id = {$safe_id}" );

if( mysql_num_rows( $rli ) ) {
  $convo = mysql_fetch_object( $rli );
   $can_access = $convo->user_one == $user_id || $convo->user_two == $user_id;
}

Notice in this example that I pulled the "logged in" user's id from the session, which assumes that you are using sessions. There are many different ways to create "logged in" user views, and that is somewhat outside the scope of this answer. The end result here is a boolean value variable $can_access which indicates whether or not the user can access the page. Assuming they can access the page, you could pull all the messages from the now validated conversation like so:

$rli = mysql_query("SELECT * FROM conversation_messages WHERE c_id = {$safe_id}");
$messages = array();
while( $message = mysql_fetch_object( $rli ) ) {
  $messages[ $message->m_id ] = $message;
}

The above gives you a PHP array containing all the messages associated with the conversation. Hope this is enough to get you started.