Member Avatar for nanakumi75

I am trying to get the usernames of users to appear in the url so that I can use $_GET['username'] to grab the username to create a link to the user's profile which can be viewed by any logged in user. So far I can only the logged in user's username to display in url.

So I did a loop/queried the database and selected usernames of all users and created a link of the usernames to appear in the url. So any logged in user can go to the users.php and click on any username to see the detailed information of that user. Only logged in users will be able to access the profile.php and users.php.

So far this is what I have

session_start();

  include 'includes/dbh.php';
  $sql = "SELECT * FROM users";
  $query = $conn->query($sql);
  $num = $query->num_rows;
  if($num > 0){
      while($row = $query->fetch_assoc()){
        $users[]= $row;
          foreach($users as $user){
                $usersUsername = $user['usersUsername'];
                echo '<a href="profile.php?user="'.$usersUsername.'">'.$usersUsername.'</a><br>';
          }     
      }
  }

But the url appears in the browser like this: http://localhost/object/profile.php?user=
I need it be something like http://localhost/object/profile.php?user=nanakumi75
The username is missing. I need some help here

  • 3 Contributors
  • 3 Replies
  • 1K Views
  • 11 Hours Discussion Span
  • Latest Post Latest Post by Dani

Dani AI

Generated

Nice catch by on the stray quote. One more thing to fix in your loop: you are building an array and then iterating over the growing array on every row, which will duplicate links. You can print each link directly inside the while loop and also make the output safe for both the URL and the HTML attribute.

// users.php
session_start();
require 'includes/dbh.php';

$sql = 'SELECT usersUsername FROM users';
$res = $conn->query($sql);

while ($row = $res->fetch_assoc()) {
    $username = $row['usersUsername'];

    // Build a proper query string and escape the href + link text
    $href = 'profile.php?' . http_build_query(['user' => $username]);
    echo '<a href="' . htmlspecialchars($href, ENT_QUOTES, 'UTF-8') . '">'
       . htmlspecialchars($username, ENT_QUOTES, 'UTF-8')
       . "</a><br>\n";
}

On the receiving page, do not trust $_GET['user']. Validate, then query with a prepared statement, and return the correct HTTP status if the user is missing or unknown. This complements ’s reminder about sanitizing output.

// profile.php
session_start();
require 'includes/dbh.php';

if (!isset($_SESSION['user_id'])) {
    http_response_code(403);
    exit('Login required.');
}

$user = $_GET['user'] ?? '';
if ($user === '') {
    http_response_code(400);
    exit('Missing user.');
}

$stmt = $conn->prepare('SELECT usersUsername, full_name FROM users WHERE usersUsername = ?');
$stmt->bind_param('s', $user);
$stmt->execute();
$profile = $stmt->get_result()->fetch_assoc();

if (!$profile) {
    http_response_code(404);
    exit('User not found.');
}

// render profile...

Practical extras:

  • If usernames may change, consider linking by a stable numeric ID (e.g., profile.php?id=123) and display the username.
  • Always use ENT_QUOTES when escaping attributes, and specify UTF-8.

Recommended Answers

All 3 Replies

Member Avatar for pritaeas 
echo '<a href="profile.php?user="'.$usersUsername.'">'.$usersUsername.'</a><br>';

should be:

echo '<a href="profile.php?user='.$usersUsername.'">'.$usersUsername.'</a><br>'; // removed one double-quote
Edited by pritaeas
Member Avatar for nanakumi75

Thanks a lot brother. You're right. It worked.

Member Avatar for Dani

Be sure to properly sanitize output!!!!!

echo '<a href="profile.php?user='. urlencode($usersUsername) .'">'. htmlspecialchars($usersUsername) .'</a><br>'; // removed one double-quote
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.