根据登录用户的ID显示数据库表中的数据

Question

I'm trying to get certain information from a database according to the user that's logged in. Right now I can get information from the columns and rows but its not user specific. Can I use a $_SESSION ? Would that work in the $query ?

PHP:

$query = "SELECT * ".
"FROM leavetable, users ".
"WHERE leavetable.users_id = users.id ";

$result = mysql_query($query) or die(mysql_error());
while($row = mysql_fetch_array($result)){
    echo ' <tr> ';
    echo ' <td> ';
    echo $row['id'];
    echo ' <td> ';
    echo $row['hours'];
    echo ' <td> ';
    echo $row['email'];
    echo ' <td> ';
    echo $row['username'];
    echo ' <td> ';
}

Answer 1

Yes, but never build your SQL queries like suggested by Mr Shahnewaz's answer. This kind of approach is vulnerable to SQL injection attacks, I'd suggest you to take some time to read about them and experiment.

The proper way to perform a parameterized query is by using a prepared statement:

$stmt = $dbh->prepare('SELECT * FROM leavetable WHERE leavetable.users_id = :id');
$stmt->bindParam(':id', $_SESSION['user_id']);
$stmt->execute();
$result = $stmt->fetch();

The key point to keep in mind is that the query string passed to the prepare method must be a plain hardcoded string. You can use named placeholers (:whatever) where needed, as shown in the example.

By the way, in this example $dbh would be an instance of the PDO class, which you might consider using instead of the old mysql_* functions.