php mysql sql select issue: syntax? structure? bind?

Question

I am having particular trouble with this code. I've redone my selects entirely using sql since my last question but I'm not getting any useful errors to help me out when I echo mysqli_error($con);

In short, when the table is created near the bottom of the code, the echo 'contents' area is the problem. It's supposed to only echo the 'contents' area of a table called opwire if the currently logged in user's "tier" (from alternate table: members) is greater than or equal to the value of "seclevel" from the original opwire table. If it's less than, it's supposed to echo Access Denied.

What I have now breaks the table and error checking gives nothing. Below the main table php I've also included all of functions.php. Am I missing something there in regards to $userTier; ? I can't get an echo back from that either.

<?php 

include_once 'functions.php';
include_once 'db_connect.php';
sec_session_start();

if(login_check($mysqli) == true) {

$con=mysqli_connect("localhost","myuser","mypass","mysqldb");
// Check connection
if (mysqli_connect_errno())
  {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
  }


function getColor($strOption)
{
   switch ($strOption)
   {
       case "Case 1":
       return "#cbae80";

       case "Case 2":
       return "#e59350";

       case "Case 3":
       return "#b7aaa4";

    }
}


 $query= "SELECT tier FROM members WHERE id = $user_ID";
 $result = mysqli_query($con,$query);
 $row = mysqli_fetch_array($result);
 $userTier = $row['tier'];

 $query = "SELECT category, contents, date, username
 FROM opwire LEFT JOIN members on opwire.userid=members.id
 WHERE seclevel <= $userTier
 UNION
 SELECT category, 'ACCESS DENIED' AS contents, date, username
 FROM opwire LEFT JOIN members on opwire.userid=members.id
 WHERE seclevel > $userTier
 ORDER BY date DESC";

 $result = mysqli_query($con,$query);

 echo "<table border='1'>
 <tr>
 <th>Category</th>
 <th>Contents</th>
 <th>Date/Time</th>
 <th>Operative</th>
 </tr>";

 while($row = mysqli_fetch_array($result))
 {
 echo "<tr>";
 echo "<td><font size=1 color='".getColor($row['category'])."'> " . $row['category'] . "</font></td>";
echo "<td><font size=1 color=#e4d6b5>" . $row['contents'] . "</font></td>";
 echo "<td><font size=1 color=silver>" . $row['date'] . "</font></td>";
 echo "<td><font size=1 color=gold>" . $row['username'] . "</font></td>";
 echo "</tr>";
 }
 echo "</table>";

mysqli_close($con);

} 

else {
   echo 'Access to this area requires security clearance. <br/>';
}

?>

and functions.php, which handles all the session / user control

<?php
function sec_session_start() {
        $session_name = 'sec_session_id'; // Set a custom session name
        $secure = false; // Set to true if using https.
        $httponly = true; // This stops javascript being able to access the session id. 

        ini_set('session.use_only_cookies', 1); // Forces sessions to only use cookies. 
        $cookieParams = session_get_cookie_params(); // Gets current cookies params.
        session_set_cookie_params($cookieParams["lifetime"], $cookieParams["path"], $cookieParams["domain"], $secure, $httponly); 
        session_name($session_name); // Sets the session name to the one set above.
        session_start(); // Start the php session
        session_regenerate_id(); // regenerated the session, delete the old one.  
}




function login($email, $password, $mysqli) {
   // Using prepared Statements means that SQL injection is not possible. 
   if ($stmt = $mysqli->prepare("SELECT id, username, password, salt FROM members WHERE email = ? LIMIT 1")) { 
      $stmt->bind_param('s', $email); // Bind "$email" to parameter.
      $stmt->execute(); // Execute the prepared query.
      $stmt->store_result();
      $stmt->bind_result($user_id, $username, $db_password, $salt); // get variables from result.
      $stmt->fetch();
      $password = hash('sha512', $password.$salt); // hash the password with the unique salt.

      if($stmt->num_rows == 1) { // If the user exists
         // We check if the account is locked from too many login attempts
         if(checkbrute($user_id, $mysqli) == true) { 
            // Account is locked
            // Send an email to user saying their account is locked
            return false;
         } else {
         if($db_password == $password) { // Check if the password in the database matches the password the user submitted. 
            // Password is correct!


               $user_browser = $_SERVER['HTTP_USER_AGENT']; // Get the user-agent string of the user.

               $user_id = preg_replace("/[^0-9]+/", "", $user_id); // XSS protection as we might print this value
               $_SESSION['user_id'] = $user_id; 
               $username = preg_replace("/[^a-zA-Z0-9_\-]+/", "", $username); // XSS protection as we might print this value
               $_SESSION['username'] = $username;
               $_SESSION['login_string'] = hash('sha512', $password.$user_browser);
               // Login successful.
               return true;    
         } else {
            // Password is not correct
            // We record this attempt in the database
            $now = time();
            $mysqli->query("INSERT INTO login_attempts (user_id, time) VALUES ('$user_id', '$now')");
            return false;
         }
      }
      } else {
         // No user exists. 
         return false;
      }
   }
}




function checkbrute($user_id, $mysqli) {
   // Get timestamp of current time
   $now = time();
   // All login attempts are counted from the past 2 hours. 
   $valid_attempts = $now - (2 * 60 * 60); 

   if ($stmt = $mysqli->prepare("SELECT time FROM login_attempts WHERE user_id = ? AND time > '$valid_attempts'")) { 
      $stmt->bind_param('i', $user_id); 
      // Execute the prepared query.
      $stmt->execute();
      $stmt->store_result();
      // If there has been more than 5 failed logins
      if($stmt->num_rows > 5) {
         return true;
      } else {
         return false;
      }
   }
}




function login_check($mysqli) {
   // Check if all session variables are set
   if(isset($_SESSION['user_id'], $_SESSION['username'], $_SESSION['login_string'])) {
     $user_id = $_SESSION['user_id'];
     $login_string = $_SESSION['login_string'];
     $username = $_SESSION['username'];

     $user_browser = $_SERVER['HTTP_USER_AGENT']; // Get the user-agent string of the user.

     if ($stmt = $mysqli->prepare("SELECT password FROM members WHERE id = ? LIMIT 1")) { 
        $stmt->bind_param('i', $user_id); // Bind "$user_id" to parameter.
        $stmt->execute(); // Execute the prepared query.
        $stmt->store_result();

        if($stmt->num_rows == 1) { // If the user exists
           $stmt->bind_result($password); // get variables from result.
           $stmt->fetch();
           $login_check = hash('sha512', $password.$user_browser);
           if($login_check == $login_string) {
              // Logged In!!!!
              return true;
           } else {
              // Not logged in
              return false;
           }
        } else {
            // Not logged in
            return false;
        }
     } else {
        // Not logged in
        return false;
     }
   } else {
     // Not logged in
     return false;
   }
}

?>

Answer 1

$user_ID isn't in scope when called from the page. It has been stuffed into the session, so change.

$query= "SELECT tier FROM members WHERE id = $user_ID";

to

$user_id = $_SESSION['user_id'];
$query = "select tier from members where id = $user_id";

While you're at it, this query will probably be more efficient than the union you currently have:

select
    category, 
    case when <= $userTier then contents else 'ACCESS DENIED' end as contents, 
    date,
    username
from
    opwire o
        left join
    members m
        on o.userid = m.id
order by
    date desc