Using Session ID for username INSERT in PHP

Question

Trying to run a Query at the moment, i've managed to get it working with just adding the exact username but when I try and use the current query to use the $_Session identified username it dosn't work.

<?php 
    include ("config.php"); 
    session_start();    
    $username = $_SESSION['username'];
    $stmt = $db->exec ("UPDATE users SET lastlogindate = NOW() WHERE username = '$username'");
?>

EDIT - Login.php code

<?php 
    require("config.php"); 
    $submitted_username = ''; 
    if(!empty($_POST)){ 
        $query = " 
            SELECT 
                id, 
                username, 
                password, 
                salt, 
                email 
            FROM users 
            WHERE 
                username = :username 
        "; 
        $query_params = array( 
            ':username' => $_POST['username'] 
        ); 

        try{ 
            $stmt = $db->prepare($query); 
            $result = $stmt->execute($query_params); 
        } 
        catch(PDOException $ex){ die("Failed to run query: " . $ex->getMessage()); } 
        $login_ok = false; 
        $row = $stmt->fetch(); 
        if($row){ 
            $check_password = hash('sha256', $_POST['password'] . $row['salt']); 
            for($round = 0; $round < 65536; $round++){
                $check_password = hash('sha256', $check_password . $row['salt']);
            } 
            if($check_password === $row['password']){
                $login_ok = true;
            } 
        } 

        if($login_ok){ 
            unset($row['salt']); 
            unset($row['password']);
            $_SESSION['user'] = $row;
            header("Location: main.php"); 
            die("Redirecting to: main.php");    
        } 
        else{ 
            print("Login Failed."); 
            $submitted_username = htmlentities($_POST['username'], ENT_QUOTES, 'UTF-8'); 
        } 
    }; 
?>

Use prepared statements and not just that error might go away. — juergen d
– juergen d, Commented Nov 14, 2013 at 19:37
What "doesn't work"? What do you see if you echo "UPDATE users SET lastlogindate = NOW() WHERE username = '$username'";? Have you checked for any errors from the database? — gen_Eric
– gen_Eric, Commented Nov 14, 2013 at 19:39
What does "it doesn't work" mean? Do you set $_SESSION['username'] elsewhere? Can you echo or var_dump $username and/or $_SESSION['username'] to see that they are set prior to update attempt? — long
– long, Commented Nov 14, 2013 at 19:40

Hamed Kamrava · Accepted Answer · 2013-11-15 20:30:07Z

3

You set $row into $_SESSION['user'] in login.php and then fetch that by $_SESSION['username'] by mistake, you should use $_SESSION['user'] instead.

Try this :

<?php
    include ("config.php"); 
    session_start();    
    $username = $_SESSION['user'];
    $stmt = $db->prepare("UPDATE users SET lastlogindate = NOW() WHERE username = ?");
    $stmt->bindParam(1, $username['username']);
    $stmt->execute();
?>

edited Nov 15, 2013 at 20:30

answered Nov 14, 2013 at 19:45

Hamed Kamrava

13k34 gold badges93 silver badges128 bronze badges

Sign up to request clarification or add additional context in comments.

10 Comments

user2932546 Over a year ago

Dosen't add date to table unfortunately. Maybe $_SESSION username doesn't bring up the logged on users username.

user2932546 Over a year ago

Nothing mate...probably my issue :(

user2932546 Over a year ago

Changed username to user and got output of Array...now im confused

user2932546 Over a year ago

When I do print_r it shows Array ( [username] => [user] => Array ( [id] => 7 [username] => deason [email] => [email protected] ) )

user2932546 Over a year ago

No luck...its like I have the two USERNAME within the session array.

|

Collectives™ on Stack Overflow

Using Session ID for username INSERT in PHP

1 Answer 1

10 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

10 Comments

Your Answer

Sign up or log in

Post as a guest

Related