I currently have a function that is pulling user tickets from my database. It is pulling that data correctly but for some reason instead of echoing the ticket numbers on two separate lines it is placing them in the first row of the table. Can anybody help me figure out why this would be happening?
This is the function:
function findUserTickets() {
include_once("dbh.php");
$id = $_SESSION['id'];
$sql = "SELECT * FROM tickets WHERE uid=$id";
$result = mysqli_query($conn, $sql);
while($row = mysqli_fetch_array($result)) {
echo "Ticket #".$row['tid'];
}
mysqli_close($conn);
}
This is the HTML code:
<ul>
<?php
include("includes/functions.inc.php");
include_once("includes/dbh.php");
$userID = $_SESSION['id'];
$strSQL = "SELECT * FROM tickets WHERE uid='$userID'";
$rs = mysqli_query($conn, $strSQL);
while ($row = mysqli_fetch_array($rs)) {
?>
<li>
<div class="hk_sug_domian_name">
<p>
<?php echo findUserTickets(); ?>
</p>
</div>
<div class="hk_domain_price">
<span class="active_price"><?php echo checkTicketStatus(); ?> </span>
<div class="hk_promot_btn"><a class="hk_btn" href="progress.php">View</a></div>
</div>
</li>
<?php
}
mysqli_close($conn);
?>
</ul>

echo "Ticket #".$row['tid'];without any line breaks.mysqliyou should be using parameterized queries andbind_paramto add user data to your query. DO NOT use string interpolation or concatenation to accomplish this because you have created a severe SQL injection bug. NEVER put$_POSTor$_GETdata directly into a query, it can be very harmful if someone seeks to exploit your mistake.