mysql and php - Retrieving data from database based on user logged in

Question

before I go ahead and attempt to create a website, I wanted to know if pulling a users content from a database depending on which user is logged in can be determined by a $_SESSION variable. So for example if I want all the messages for user 'example':

$_SESSION['username'] = $_POST['username'] // set when the user logs in
$username = $_SESSION['username']

$data = mysql_query("Select * from messagesTable where username = '$username'")
while($row = mysql_fetch_array($data)) {
echo $row['message']
}

I wanted to know if this would be the right way to do something like this and also if its safe to return (personal) data based on a session variable.

I haven't got that much experience in either of these languages but I like to learn with experience, please tell me if it's not clear. Thanks.

Michael Berkowski · Accepted Answer · 2011-12-29 02:58:15Z

3

It is safe to return user data based on a $_SESSION variable if you are certain of its validity because you set it yourself in code. It is not safe to return data based on a session variable that you get from $_POST.

You initially set

$_SESSION['username'] = $_POST['username'];

So unless you have verified with a password or otherwise that this user is who he claims to be, you should not use $_POST['username'] to return other information. If your login process (which we cannot see above) already verifies that $_POST['username'] is valid, you can use it as a source to retrieve additional information.

You will need also to filter against SQL injection:

$_SESSION['username'] = mysql_real_escape_string($_POST['username']);

answered Dec 29, 2011 at 2:58

Michael Berkowski

271k47 gold badges450 silver badges395 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Andy Lobel Over a year ago

yea thanks sorry i just typed that out, my actual code includes all the other password checks and stuff lol

Daniel Castro Over a year ago

And also, unrelated to the question, you could look into mysqli or PDO, since the mysql functions are now deprecated. Hope it helps. =)

italiano40 · Accepted Answer · 2011-12-29 02:57:02Z

0

that isn't standard and probably not safe since phpsession stay open even when a browser tab maybe not be open to the site since the cookie isn't eased until the browser is shutdown and also you could just send a post parameter to the site and get the info too so login scripts are a little more advanced, you could something like have a unique key that is generate upon logging in and when they leave the site using javascript delete the cookie something like that

answered Dec 29, 2011 at 2:57

italiano40

4969 silver badges19 bronze badges

Comments

Philip · Accepted Answer · 2011-12-29 03:02:30Z

0

It wouldnt be the correct way to do it no.

May i suggest you go read the php/mysql docs and or a good book before attempting a website.

You also need to look into security(session hijacking, cross scripting, mysql attacks, form tokens, login systems, user roles/permissions). Google search is your friend...

answered Dec 29, 2011 at 3:02

Philip

4,5822 gold badges22 silver badges28 bronze badges

3 Comments

Andy Lobel Over a year ago

u gona actually say why its the wrong way to do it or just tell me to read a book lol

Philip Over a year ago

Cleary reading the docs or a book is not an option :P Ive just given you 6/7 good reasons, or did you not read that either?

Andy Lobel Over a year ago

o right, i assumed there was more because you said 'also' lol

Psi · Accepted Answer · 2017-03-24 12:54:49Z

-2

<?php
session_start();
    $username="";
    if($_SESSION['username']==true){
            $username=$_SESSION['username'];
            $conn=mysql_connect('localhost','user','passwd') or die("Unable   
                   to connect to database" .mysql_error());
            mysql_select_db('DBName') or die(mysql_error());
            $sql="SELECT * FROM tablename WHERE username='$username'";
            $retval=mysql_query($sql, $conn) or die("Could not perform query" 
              .mysql_error());
            while($row=mysql_fetch_array($retval)){
                echo {$row['message']};
            }
            mysql_free_result($retval);
            mysql_close($conn);
    }
    else{
        return false;
        header("Location:login.php");
    }
?>

edited Mar 24, 2017 at 12:54

Psi

6,8283 gold badges19 silver badges30 bronze badges

answered Mar 24, 2017 at 11:49

Kihika Sam

1

Collectives™ on Stack Overflow

mysql and php - Retrieving data from database based on user logged in

4 Answers 4

2 Comments

Comments

3 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

2 Comments

Comments

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related