通过数据库获取结果的问题，其中会话ID登录在用户ID中，我将不得不检查通过链接获取的uid

Question

$getwhole_messages = $db->query("
SELECT * FROM `user_messages` 
WHERE `sender_id`='".$_SESSION['RVuser']."' ||
`reciever_id`='".$_SESSION['RVuser']."' &&
`sender_id`='".$_GET['uid']."' ||
`reciever_id`='".$_GET['uid']."'"
);

Where as I want to put check that will let me know that session id is match with uid. It would be in sender_id or reciever_id.

Answer 1

Too long for a comment, beyond what tadman said (You're at severe risk of SQL injection attacks), this query is left way too open.

You have this matching when any of these conditions exist:

Condition 1: When sender_id = $_SESSION['RVuser']

Condition 2: When receiver_id = $_SESSION['RVuser'] AND sender_id = $_GET['uid']

Condition 3: When receiver_id = $_GET['uid']

So all it would take is for someone to load your page with ?uid=# to get information because of condition 3.

Answer 2

Always sanitize vulnerable inputs! I'm assuming you're using MySQLi in my example.

$select = sprintf("SELECT * FROM user_messages WHERE sender_id=%d || reciever_id=%d && sender_id=%d || reciever_id=%d;",
  $_SESSION['RVuser'],
  $_SESSION['RVuser'],
  $db->real_escape_string($_GET['uid']),
  $db->real_escape_string($_GET['uid'])
);

if($getwhole_messages = $db->query($select))
  // Prosess results
} else {
  // Output Query error
}

Please provide error details so we can provide more of an answer.