MYSQL SELECT query displaying only the data from the logged in user session

Question

I am creating an account settings page for my membership website where the user that is logged can go to edit there username, password and email. This code below shows all the users in my database to every user with the option to edit.

$result = mysql_query("SELECT * FROM user") or die(mysql_error());

I don't want that. I would like only the information for user that is logged in so they can edit there own personal information. Here is my table:

 TABLE user (
  id int(4) unsigned NOT NULL AUTO_INCREMENT COMMENT 'ID number of member',
  username varchar(32) NOT NULL COMMENT 'Username of member',
  password varchar(32) NOT NULL COMMENT 'Password of member',
  email varchar(100) NOT NULL COMMENT 'Email of member',
  level int(4) DEFAULT '1' COMMENT 'Permission Level of member',
  PRIMARY KEY (`id`)
)

Here is the php code for whole page:

<?php
ob_start(); //keep output in buffer

session_start();
require_once( 'database.php' );

include("head.php");

if (!isset($_SESSION['loggedin'])) {

?>
    <body>

DO NOT HAVE ACCESS PRIVILEDGES TO THIS PAGE.   

<?php }
elseif (isset($_SESSION['loggedin']) && ($_SESSION['adminuser']=='0' )){  //logged in and NOT an Admin
?>

<body>

        <?php
        $result = mysql_query("SELECT * FROM user") 
                        or die(mysql_error());
        ?>
<table width="600" border="0" cellspacing="1" cellpadding="0">
<form name="form1" method="post" action="">
<tr>
<td>
<table width="600" border="0" cellspacing="1" cellpadding="0">
<tr>
<td align="center"><strong>UserName</strong></td>
<td align="center"><strong>Password</strong></td>
<td align="center"><strong>Email</strong></td>
</tr>
<?php
while($row = mysql_fetch_array( $result )){
?>
<tr>
<td align="center"><? echo $row['username']; ?></td>
<td align="center"><? echo $row['password']; ?></td>
 <td align="center"><? echo $row['email']; ?></td>
<td align="center"><? echo '<a class="login" href="edit_user.php?id=' . $row['id'] . '">Edit</a>'; ?>&nbsp; &nbsp;</td>
</tr>
<?php
}
?>
<tr>
</tr>
</table>
</td>
</tr>
</form>
</table>
<?php
}

elseif (isset($_SESSION['loggedin']) && ($_SESSION['adminuser']=='1' )){  //logged in and an Admin

?>
<body class="loggedin">

<?php include("admin_menu.php"); ?>
<?php
$result = mysql_query("SELECT * FROM user") 
                or die(mysql_error());
?>

<table width="600" border="0" cellspacing="1" cellpadding="0">
<form name="form1" method="post" action="">
<tr>
<td>
<table width="600" border="0" cellspacing="1" cellpadding="0">
<tr>
<td align="center"><strong>UserName</strong></td>
<td align="center"><strong>Password</strong></td>
<td align="center"><strong>Email</strong></td>
</tr>
<?php
while($row = mysql_fetch_array( $result )){
?>
<tr>
<td align="center"><? echo $row['username']; ?></td>
<td align="center"><? echo $row['password']; ?></td>
 <td align="center"><? echo $row['email']; ?></td>
<td align="center"><? echo '<a class="login" href="edit_user.php?id=' . $row['id'] . '">Edit</a>'; ?>&nbsp; &nbsp;</td>

</tr>
<?php
}
?>
<tr>
</tr>
</table>
</td>
</tr>
</form>
</table>
<?
}
include("footer.php");
ob_flush(); //flush output buffer
?>

I've already tried these two ways to fix my problem and they didn't work:

$result = mysql_query('SELECT * FROM user "'. mysql_real_escape_string(isset($_SESSION['loggedin']) && ($_SESSION['adminuser']=='0' )) . '"') 
                        or die(mysql_error());

^ that doesn't show anything except the titles of the columns. I tried this as well and it also didn't work:

$result = mysql_query("SELECT * FROM user '". mysql_real_escape_string($_SESSION['loggedin']) . "'") 
                        or die(mysql_error());

Help please.

Read up on the MySQL [`SELECT`](http://www.firstsql.com/tutor2.htm)-statement. — Marty McVry, Apr 07 '13 at 23:03
Welcome to Stack Overflow! [Please, don't use `mysql_*` functions](http://stackoverflow.com/q/12859942/1190388) in new code. They are no longer maintained and are [officially deprecated](https://wiki.php.net/rfc/mysql_deprecation). See the red box? Learn about prepared statements instead, and use [tag:PDO] or [tag:MySQLi]. — hjpotter92, Apr 07 '13 at 23:07

score 0 · Answer 1 · edited Apr 08 '13 at 02:08

0

SELECT * FROM user WHERE id = UserId

This should solve your problem and please do a thorough search on mysqli or pdo. Stop using mysql

edited Apr 08 '13 at 02:08

Wesley Brian Lachenal

4,381
9
48
81

answered Apr 08 '13 at 00:39

Emmy Steven

93
6

I will stop using mysql. Your code worked but I have to manually put in the userid and it won't apply for other users if I set the userid to specific id number. I want every user to be able to access their own personal information and not see another users info. – JayKay Apr 08 '13 at 01:01
@JayKay is there any update from this? I am encountering the same problem and I think I need the same output as you – Angel Jun 23 '20 at 15:16

MYSQL SELECT query displaying only the data from the logged in user session

1 Answers1