PHP和MySql中的时间戳查询已更新

Question

I have these tables and i want to get news from News table, but the news that have been added after the user had logged in & he didn't see the data Depending on the Query that is shown in the PHP script.

The Users When they are logging in to the system they register their Login Time-stamp. After a while a service asks the server about the new data for that User_ID and check the seen table if the news is not in the seen table and the Current Time-stamp is Greater than the logged in Time-stamp then the news is new.

Users Table

User_ID | User_Name   |User_Login
-------------------------------
1       | John        |2016-04-13 16:01:12
2       | Carl        |2016-04-13 16:13:22
3       | Tomas       |2016-04-13 16:01:01
4       | Adam        |2016-04-13 16:04:44
5       | Nancy       |2016-04-13 16:04:37

News Table

News_ID | News_Text      | News_Post_TimeStamp          
----------------------------------------------
1       | Hello World    | 2016-04-13 16:09:23
2       | This is My car | 2016-04-13 16:10:24
3       | I had Ate pizza| 2016-04-13 16:11:40
4       | Leave Me Alone | 2016-04-13 16:15:30
5       | C++ Programming| 2016-04-13 16:09:50

Seen Table

ID   | User_Id  | News_Id
---------------------------
1    |  1       | 2
2    |  1       | 3
3    |  4       | 1
4    |  5       | 3
5    |  1       | 4

UPDATE This is my PHP Script Code:

 <?php

require('config.php');
$conn = mysqli_connect($servername, $username, $password, $db);
$query="SELECT * FROM news,users WHERE news.news_id NOT IN (SELECT news_id FROM seen WHERE user_id = '".$_GET['id']."') AND users.user_login<Now() ";


$result = mysqli_query($conn,$query);
$rows = array();
echo mysqli_error($conn);

while($row = mysqli_fetch_assoc($result)) {

    $rows[] = $row;
}

echo json_encode($rows);
?> 

and This is the JSON Format:

 [{"News_id":"1","News_Text":"C++programming","news_post_timestamp":"2016-     04-13 16:09:41","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"1","News_Text":"C++programming","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"},{"News_id":"2","News_Text":"Pizza","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"2","News_Text":"Pizza","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"},{"News_id":"3","News_Text":"Android","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"3","News_Text":"Android","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"},{"News_id":"4","News_Text":"Ahmad","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"4","News_Text":"Ahmad","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"},{"News_id":"5","News_Text":"Toto","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"5","News_Text":"Toto","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"},{"News_id":"6","News_Text":"JaVA","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"6","News_Text":"JaVA","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"},{"News_id":"7","News_Text":"Computer","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"7","News_Text":"Computer","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"},{"News_id":"8","News_Text":"Test","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"8","News_Text":"Test","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"},{"News_id":"9","News_Text":"Test","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"9","News_Text":"Test","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"},{"News_id":"10","News_Text":"Al Hasasd","news_post_timestamp":"2016-04-13 16:47:44","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"10","News_Text":"Al Hasasd","news_post_timestamp":"2016-04-13 16:47:44","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"}]

There is a duplicate in the Results , if anyone can tell me how to remove duplicate ?

Answer 1

Your SQL should be this (exemple with User_ID 1)

SELECT * 
FROM news n
WHERE news_id NOT IN (SELECT news_id FROM news_seen WHERE user_id = 1)
AND News_Post_TimeStamp > (SELECT User_Login FROM user_table WHERE User_ID = 1)

(adapt user_table accordingly)

---

But prior to simply do this, you should adapt your PHP code because what you are doing is an invitation to a SQL injection.

Ideally you should use parameterized queries .

But, assuming your USER_ID is CHAR type as you had quotes in your query, you can just make your code a bit safer using this simple sanitize function that I added to your code.

<?php

require('config.php');
$conn = mysqli_connect($servername, $username, $password, $db);

$userid = sanitize($_GET['id']);
$query="SELECT * FROM news WHERE news_id NOT IN (SELECT news_id FROM news_seen WHERE user_id = '$userid') AND News_Post_TimeStamp > (SELECT User_Login FROM user_table WHERE User_ID = '$userid')";

$result = mysqli_query($conn,$query);
$rows = array();
echo mysqli_error($conn);

while($row = mysqli_fetch_assoc($result)) { 
    $rows[] = $row;
}

echo json_encode($rows);




function sanitize($data)
{
    // remove whitespaces (not a must though)
    $data = trim($data); 

    // apply stripslashes if magic_quotes_gpc is enabled
    if(get_magic_quotes_gpc()) 
    {
    $data = stripslashes($data); 
    }

    // a mySQL connection is required before using this function
    $data = mysql_real_escape_string($data);

    return $data;
}



?>