mysql_query to only show posts by the user

Question

I'm creating a twitter-like stream of posts using PHP. If the user only wants to see posts that he created, how should I write the mysql query?

Here's what I have now: mysql_query("SELECT * FROM timeline ORDER BY dt DESC");

I assume that I need to add a WHERE after timeline to indicate the user, but not sure what the proper code is. Would it be WHERE $_SESSION['username'] ?

Answer 1

You're on the right lines.

Watch the contents of $_SESSION['username']. You should really escape it first:

$usr = mysql_real_escape_string($_SESSION['username']);

then

mysql_query("SELECT * FROM timeline WHERE username = '$usr' ORDER BY dt DESC ");

I don't know what your user name field is called, so substitute.

Note: mysql is deprecated - use mysqli or PDO

Answer 2

While I wouldn't recommend this, it should work:

SELECT * 
FROM timeline 
WHERE user = '" . $_SESSION['username'] . "'
ORDER BY dt DESC

I would suggest using paramaterized queries and using pdo instead!