Connecting a primary key to row of another table in MySQL

Question

I created two tables:

• First table, "users", consisting of 'user_id' (primary key), 'user_name', 'user_email' and 'user_pw'

• Second table, "characters", consisting of of 'char_id' (primary key), 'uid', 'name', 'race' and age.

My intention is to let users create characters while the database assigns each created character to the correct user_id, so it's possible to find out who created what character.

(The login system is already working).

I started with the form, to fill in the character table:

<form method="post" action="includes/createcharacter.inc.php">
    <input type="text" name="name">
    <input type="text" name="race">
    <input type="number" name="age">
<button type="submit" name="create">Erstellen</button>
</form>

Followed by the createcharacter.inc.php file, which is doing the php behind it:

<?php

if (isset($_POST['create'])) {

include_once 'dbh.inc.php';

$name = mysqli_real_escape_string($conn, $_POST['name']);
$race = mysqli_real_escape_string($conn, $_POST['race']);
$age = mysqli_real_escape_string($conn, $_POST['age']);

$sql = "INSERT INTO characters (name, race, age) VALUES ('$name', '$race', '$age');";
mysqli_query($conn, $sql);
header("Location: ../createcharacter2.php?charactercreated");
exit();

}

It's no problem to insert the character data of a name, race and age now. But I can't figure out how to 'connect' the 'uid' row of my character-table with the user_id row of my user-table to assign every created character to a user_id.

I tried searching for an answer but I didn't know how to formulate it properly. I'm a beginner, so a detailed explanation would be appreciated.

Answer 1

Sweet jesus, sure took me smol brain all night to figure out how to insert it with the session. Here's my solution:

I simply added this input in my form:

if (isset($_SESSION['u_id'])) {

    echo "
<form method='post' action='includes/createcharacter.inc.php'>
<input type='hidden' name='created_by' value='".$_SESSION['u_id']."'>
<input type='text' name='name'>
<input type='text' name='race'>
<input type='number' name='age'>
<button type='submit' name='create'>Erstellen</button>
</form>";

}

I also changed the name of the column 'uid' to 'created_by' like the - now deleted respond - suggested. Makes more sense to me. After that, the include-file looked like this:

    <?php

if (isset($_POST['create'])) {

include_once 'dbh.inc.php';

$name = $_POST['name'];
$race = $_POST['race'];
$age = $_POST['age'];
$created_by = $_POST['created_by'];


$sql = "INSERT INTO characters (name, race, age, created_by) VALUES ('$name', '$race', '$age', '$created_by');";
mysqli_query($conn, $sql);
header("Location: ../createcharacter2.php?charactercreated");
exit();

}

Thanks for the advice regarding the risk of sql injection attacks. I'm programming on XAMPP right now, but I'll make sure to learn more about prepared and bound queries.