如何从$ _SESSION和MySQL用户ID验证用户ID

Question

I have a problem with MySQL query and condition. The main problem is user with another ID can see / edit the same leads even though his id != owner.

I tried to change the vars and add '' or "", but none of these help.

$myuser_query = mysqli_query($conn,"SELECT * FROM users WHERE id = '".$_SESSION["id"]."'");
$myuser = mysqli_fetch_assoc($myuser_query);

$myleads = "SELECT * FROM leads WHERE owner = '".$myuser["id"]."' AND status = 1 OR status = 2 ORDER BY RAND() LIMIT 1";
$newleads = $conn->query($myleads);
 if ($newleads->num_rows >= 1) {

(Here it's all the client side that's showing the date.)

Answer 1

You need to add parenthesis around the OR conditions in your query. Change this:

$myleads = "SELECT * FROM leads 
           WHERE owner = '".$myuser["id"]."' AND status = 1 OR status = 2 
           ORDER BY RAND() LIMIT 1";

To:

$myleads = "SELECT * FROM leads 
           WHERE owner = '".$myuser["id"]."' AND (status = 1 OR status = 2)
           ORDER BY RAND() LIMIT 1";