Member Avatar for just_program

hi my name is lester page and i have a problem that is displaying links to the owner of the comment. the code is working fine but the thing is the links are being displayesd whether the logged in user is the owner or not. the database i have heading and comment with the user name and the author the author is the same as the username. please help below is the code

<?php
include('includes/setting.php');
$for=mysql_query('SELECT * FROM commentsss');

while($fores=mysql_fetch_array($for)){
echo "<table width='85%' border='1' align='center'>
  <tr>
    <td width='126' rowspan='2'><p><strong><br><br><br><br>Username</strong>: ".$fores['username']."</p><strong><br>Email:</strong> <p>".$fores['email']."</p></td>
    <td height='121' colspan='2'><h2>Title: ".$fores['heading']."</h2></td>
    <td width='126' rowspan='2'><h4><br><br><br><br><br><a href=\"editscommsss.php?post_id=
    ".$fores['post_id']."&heading=".$fores['heading']."\">Edit</a> | <a href=\"deletecommsss.php?post_id=
    ".$fores['post_id']."&heading=".$fores['heading']."\">Delete</a></h4></td>
    </tr>
  <tr>
    <td height='136' colspan='2'><strong>Comment:</strong><p>".$fores['comment']."</p></td>
    </tr>
  </table>";
}
?>

thank you in advance

  • 2 Contributors
  • 1 Reply
  • 125 Views
  • 3 Hours Discussion Span
  • Latest Post Latest Post by broj1

Dani AI

Generated

The symptom you describe (Edit/Delete links visible for every comment) usually means the ownership check is either not happening, or the check is comparing the wrong values. pointed you in the right direction: the UI should only render action links after confirming the current session user is the comment owner. Beyond that basic idea, follow a few safer practices so the UI and the edit/delete endpoints stay correct and secure.

Keep it simple and safe:

  • Store a numeric user id in the session and compare by id (not username strings) to avoid case/whitespace mismatches.
  • Query each comment with its author_id and only render links when that id equals the current session id.
  • Never rely on the UI alone: the edit and delete pages must re-check ownership server-side before changing data.
  • Use prepared statements (PDO or mysqli), escape output with htmlspecialchars, and use POST + CSRF tokens for destructive actions instead of raw GET links.

Example pattern (minimal, modern approach):

session_start();
$currentUser = $_SESSION['user_id'] ?? null;

$stmt = $pdo->query('SELECT id, title, body, author_id FROM comments');
while ($c = $stmt->fetch(PDO::FETCH_ASSOC)) {
    echo '<h2>' . htmlspecialchars($c['title']) . '</h2>';
    echo '<p>' . htmlspecialchars($c['body']) . '</p>';
    if ($currentUser !== null && (int)$c['author_id'] === (int)$currentUser) {
        echo '<a href="edit.php?id=' . urlencode($c['id']) . '">Edit</a>';
        echo '<form method="post" action="delete.php" style="display:inline">'
           . '<input type="hidden" name="id" value="' . htmlspecialchars($c['id']) . '">'
           . '<input type="hidden" name="csrf" value="' . htmlspecialchars($_SESSION['csrf_token']) . '">'
           . '<button type="submit">Delete</button></form>';
    }
}

Quick troubleshooting tips: ensure session_start() runs before any output, verify the session key actually contains the logged-in id, check types (use strict/int casts), and make sure edit/delete endpoints perform the same owner check before modifying the row. For reference see the PHP pages on session_start() and htmlspecialchars(), and the OWASP CSRF guidance for safe form handling.

Member Avatar for broj1

Where is the information about the logged-in user stored? Let's assume that is stored in the session in the $_SESSION['loggedin_username'] variable. Now while fetching rows you have to check whether the fetched username equals to the logged-in username. So the code would be something like:

<?php
include('includes/setting.php');
$for=mysql_query('SELECT * FROM commentsss');
while($fores=mysql_fetch_array($for)){
echo "<table width='85%' border='1' align='center'>
  <tr>
    <td width='126' rowspan='2'><p><strong><br><br><br><br>Username</strong>: ".$fores['username']."</p><strong><br>Email:</strong> <p>".$fores['email']."</p></td>
    <td height='121' colspan='2'><h2>Title: ".$fores['heading']."</h2></td>
    <td width='126' rowspan='2'>";
    // Here you check the username from the database with the logged-in username
    // and disply the links if they match
    if($fores['username'] == $_SESSION['loggedin_username']) {
        echo "<h4><br><br><br><br><br><a href=\"editscommsss.php?post_id=".$fores['post_id']."&heading=".$fores['heading']."\">Edit</a> | <a href=\"deletecommsss.php?post_id=
        ".$fores['post_id']."&heading=".$fores['heading']."\">Delete</a></h4>";
    }
    echo "</td></tr>
  <tr>
    <td height='136' colspan='2'><strong>Comment:</strong><p>".$fores['comment']."</p></td>
    </tr>
  </table>";
}
?>

I didn't test this piece of code since obviously I do not have enough data. But you get the concept.

Edited by broj1
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.