如何在PHP中使用会话通过电子邮件ID获取表的其他数据

Question

My table name- persons my table columns

    fname lname email password 

I want to get fname from table using session by email id or password. I want to display fname on another page after login. please help me .

session_start();

$cser = mysqli_connect("localhost", "root", "", "srptech") or die("connection failed:" . mysqli_error());

if (isset($_REQUEST['login'])) {
    $c = $_REQUEST['fname'];
    $a = $_REQUEST['email'];
    $b = $_REQUEST['password'];

    $res = mysqli_query($cser, "select fname from persons where email='$a'and password='$b'");

    while ($row = mysql_fetch_array($res)) {
        $fname = $row['fname'];

        $_SESSION["user-name"] = $fname;

    }

    $result = mysqli_num_rows($res);
    if ($result == true) {
        $_SESSION["login"] = "1";

        $_SESSION["email-id"] = $a;

        header("location:my-account.php");
        exit();
        session_write_close();
    } else {
        header("location:index.php?err=1");
    }

}

And another page - my-account.php

session_start();

if (!isset($_SESSION["login"])) // $_SESSION is a variable and login is a SESSION name
{
    header("location:index.php");
} else {
    echo 'Welcome' . '<h3>' . $_SESSION["email-id"] . '</h3>';
    echo 'Welcome' . '<h3>' . $_SESSION["user-name"] . '</h3>';

}

Email is echo on another page but fname is not displayed (echo)

Error- Invalid user-name.

How can echo fname on another page? Please help me.

Answer 1

I updated your script, now it's safe to use no SQL injection possible

<?php
    if (isset($_REQUEST['login']))
    {
        $Email = $_REQUEST['email'];
        $Password = $_REQUEST['password'];

        $DB = new mysqli("localhost", "root", "", "srptech");

        if ($DB->connect_errno)
        {
            printf("Connect failed: %s\n", $DB->connect_error);
            exit();
        }

        $STMT = $DB->prepare("SELECT `fname` FROM `persons` WHERE `email` = ? AND `password` = ? LIMIT 1");
        $STMT->bind_param("ss", $Email, $Password);
        $STMT->execute();
        $STMT->bind_result($FirstName);
        $STMT->fetch();
        $STMT->close();

        if ($FirstName)
        {
            session_start();

            $_SESSION["user-name"] = $FirstName;
            $_SESSION["login"] = "1";
            $_SESSION["email-id"] = $Email;

            header("location:my-account.php");
            exit();
        }

         header("location:index.php?err=1");
    }
?>