Displaying customer information upon logging in

Question

I'm hoping someone can help me with my problem. Basically what I am trying to create is a log in system, whereas customers can log in to view their package details (address, billing number etc.) But i'm confused on how I can display a customers results based upon who has logged in.

So far I have 2 tables, one called userlogin and one called userinfo. Userlogin simply contains username and password data, whereas userinfo will contain all of the the customers information (address, billing number etc.). These two tables share a row with the same value, user_id. I have tryed to use MYSQL inner join and such, but i'm unsure where I am going wrong, and why I can't return one users information, and it instead shows me all results, or none.

Here is the code for my 2 pages, first the log in page.

    //Login.php
session_start();
if($user_is_valid) {
    //Store the id in the session
    $_SESSION['user_id'] = $user_id;

    //Redirect to the home-page
    header('Location: home.php');
    exit;
}
////// Login Section.
$Login=$_POST['Login'];
if($Login){ // If clicked on Login button.
    $username=$_POST['username'];
    $password=$_POST['password']; // Encrypt password with md5() function.

    // Connect database. 
    //connect
    $con = mysql_connect("*****","*****","*****");
    if (!$con){
        die('Could not connect: ' . mysql_error());
    }
    //datebase
    mysql_select_db("*****", $con);

    // Check matching of username and password.
    $result=mysql_query("select * from userlogin where username='$username' and password='$password'");
    if(mysql_num_rows($result)!='0'){ // If match.
    $_SESSION ['user']['id'] = $result ['id'];
        session_register("username"); // Craete session username.
        header("location:home.php"); // Re-direct to main.php
        exit;
    }
    else { // If not match.
        $message="--- Invalid Username or Password ---";
    }

} // End Login authorize check.

and here is the home page (the page which will display the customers information).

//Home.php
if(!strlen(trim($_SESSION['username']))) {
 header("Location:login.php");
 exit();
}
session_start();
echo $_SESSION['user_id']; //This will output the value we set earlier

$con = mysql_connect("*****","*****","*****");
if (!$con){
    die('Could not connect: ' . mysql_error());
}
//datebase
mysql_select_db("*****", $con);
//select
$user_id = $_GET['user_id'];
$result = mysql_query("SELECT userinfo.name as name, userinfo.address as address, userlogin.username as username  
                       FROM userinfo
                       INNER JOIN userlogin ON userlogin.user_id = userinfo.user_id
                       WHERE userlogin.user_id = userinfo.user_id");

while($row = mysql_fetch_array($result)){
    echo $row['name'] . '</br> ';
    echo $row['username'] . '</br> ';
    echo $row['address'] . '</br> ';
}

So in a nut shell, what I am trying to do is create a system whereas a user can go onto our website, log in and then have their information displayed for them, but i'm unsure where I have go wrong, and quite honestly I've confused myself.

I understand that I might not have explained this well, or my code might not be very clean, but please any feedback, questions, or if you could just point me in the right direction i'd greatly appreciate it! Thank you!

Answer 1

change:

$result = mysql_query("SELECT userinfo.name,userinfo.address,userinfo.username  
FROM userinfo
INNER JOIN userlogin ON userlogin.user_id = userinfo.user_id
WHERE userlogin.user_id = $user_id;");

into

$result = mysql_query("SELECT userinfo.name,userinfo.address,userinfo.username  
FROM userinfo
INNER JOIN userlogin ON userlogin.user_id = userinfo.user_id
WHERE userlogin.user_id = $user_id");

you have a semicolon after your php var .

Answer 2

You can consider the session as a place to store state between "pageloads"/requests. In this case state could be whether the user has been authenticated and if so what identity the current user has. For example, when the user is logged in and you have verified their identity in the database/backend you initialize a session and store their user id. This allows you to retrieve this id in any following requests until you destroy the session.

//Login.php
session_start();
if($user_is_valid) {
    //Store the id in the session
    $_SESSION['userid'] = $userId;

    //Redirect to the home-page
    header('Location: Home.php');
    exit;
}

This allow us to retrieve userid on any subsequent pageloads by simply initializing the session and getting the contents of $_SESSION['userid'], like so:

//Home.php
session_start();
echo $_SESSION['userid']; //This will output the value we set earlier

Finally, maybe we also need a page that clears what we have stored in the session for the current user, i.e. in the case the user wants to log out:

//Logout.php
session_start();
$_SESSION = array();
session_destroy();

This setup also makes sure that the user can only see the information they are allowed to. Even though sessions can be tampered with if one is not careful they are a lot harder to mess with than simply changing some parameter in the query-string.

As for your actual database interaction I would recommend switching to mysqli or MySql PDO as the old mysql has been deprecated, see: http://php.net/pdo_mysql or http://php.net/mysqli

This also allow you to easily take advantage of prepared statements as an easy way for avoiding SQL-injection problems. Obviously, there is some overhead and issues connected to using prepared statements as well, but in your case I think it would be easiest for you. Check out MySQL Prepared Statements or do a quick stackoverflow search.