Member Avatar for nonshatter

Hey guys,

I am really close with this but can't quite get it right... All I am trying to do is retrieve the users details based on their 'u_id' and display them.

<?php
require ('dbconnect.php');
	$user = $_SESSION['username'];         //Get the users username
	$requestuid = mysql_query("SELECT u_id FROM user_usr WHERE u_username = '$user'");      //Get the users u_id based on their username
	$resultuid = mysql_fetch_assoc($requestuid);
	echo $resultuid['u_id'];          //THIS PRINTS THE USERS ID NO
?>

<table>
	<tr>
		<td>Gender:</td>
		<td>
			<?php 
                                   $request = mysql_query("SELECT u_gender FROM users WHERE u_id = '$resultuid'");  
				$result = mysql_fetch_assoc($request); 
				echo $result['u_gender'];    //THIS DOESN'T PRINT THE USERS GENDER
			?>
		</td>
	</tr>
</table>

In my head this should work, but I can't quite get it. Can anyone see where I'm going wrong?

Many Thanks,
Nonshatter

  • 2 Contributors
  • 2 Replies
  • 91 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by nonshatter

Dani AI

Generated

The immediate cause in this thread was that the fetched row was being reused incorrectly in the second query; pointed that out and that fix resolves the symptom. A few extra points below will help avoid the same pitfall and make the code safer and more robust going forward.

Always start the session and validate its value before using it. Confirm the first query actually returned a row before using any fields. Check that you are querying the right table/column names (the sample used different table names in the two queries). When using an id in a WHERE clause prefer parameterized queries or, at minimum, cast the id to an integer to avoid injection and type mismatches. Also escape output when printing to HTML (for example with htmlspecialchars) to prevent XSS.

Consider simplifying to a single, parameterized query that returns all needed columns and use modern APIs (PDO or mysqli) instead of the old mysql extension. Example using PDO (adapt connection details and column/table names to your schema):

<?php
session_start();
if (empty($_SESSION['username'])) exit;

$pdo = new PDO('mysql:host=127.0.0.1;dbname=yourdb;charset=utf8mb4','dbuser','dbpass',[
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
]);

$stmt = $pdo->prepare('SELECT id, gender FROM users WHERE username = :u LIMIT 1');
$stmt->execute([':u' => $_SESSION['username']]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

if ($user) {
    echo (int)$user['id'] . ' - ' . htmlspecialchars($user['gender'], ENT_QUOTES, 'UTF-8');
}

Quick checklist while debugging:

  • call session_start() and confirm $_SESSION['username'] is set;
  • verify the first query returned a row (fetch result is not false);
  • log or display DB errors during development (PDO::ERRMODE_EXCEPTION);
  • prefer one query to fetch all needed fields where possible;
  • migrate from mysql_* to mysqli/PDO for security and PHP compatibility (see PDO prepared statements: https://www.php.net/manual/en/pdo.prepared-statements.php).

Recommended Answers

All 2 Replies

Member Avatar for colweb

Line 6 look correct. but in line 14 you use $resultuid.

To get this working insert a line before line 6 and change the current line 6 and 14 like so:

$ruid = $resultid['u_id'];
echo $ruid;

// line 14:
$request = mysql_query("SELECT u_gender FROM users WHERE u_id = '$ruid'");
Member Avatar for nonshatter

Perfect. Thanks for your help!
:icon_cool:

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.