-1

So I have two pages. One shows all of the users who have filled out the form. On this page the ID is hyperlinked to the users individual page. On the individual page it should only show their individual information. When I do it, it still shows everyones information and I can't figure out how to change it.

This is my table for all the users.

<?php


//Establish the connection to the database server
$conn = mysql_connect("localhost","root", "MIS42520!$") or die (mysql_error());

//Tell the connection which database to user_error
mysql_select_db("assignment_3", $conn);

//Tell the database what you want, with an SQL statement
$sql = "select id, firstname, lastname, emailaddress from usertable";

//Run the sql statement against the connection
$result = mysql_query($sql, $conn) or die (mysql_error());

//Process the result set $result
print "<center><table id='adminTable' border=1>";
print "<tr><th>ID</th><th>First Name</th><th>Last Name</th> <th> Email Address</th> </tr>";
while($row = mysql_fetch_array($result)){ 
  echo "<tr>";
  echo "<td><a href=\"showUser.php?id={$row['id']}\">{$row['id']}</a></td>";
  echo "<td>" . $row['firstname'] . "</td>";
  echo "<td>" . $row['lastname'] . "</td>";
  echo "<td>" . $row['emailaddress'] . "</td></tr>";  
}

echo "</table></center>"; //Close the table 


?>

My table for the single user is essentially exactly the same but I added the following on top

$id= $_GET['id'];
esaunde1
  • 91
  • 2
  • 3
  • 11
  • 3
    Please, [don't use `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php), They are no longer maintained and are [officially deprecated](https://wiki.php.net/rfc/mysql_deprecation). Learn about [prepared statements](http://en.wikipedia.org/wiki/Prepared_statement) instead, and use [PDO](http://us1.php.net/pdo) or [MySQLi](http://us1.php.net/mysqli). – Jay Blanchard Nov 14 '14 at 17:11

2 Answers2

1

Change your $sql variable to this:

$sql = "select id, firstname, lastname, emailaddress from usertable where id='".htmlentities($_GET['id'])."'";
DrRoach
  • 1,320
  • 9
  • 16
-1

Well.. you need to change the statement for the page of the only one user i think Try this

$sql = "select id, firstname, lastname, emailaddress from usertable where id =".$id;

And as @jay-blanchard say in the comment, try not to use deprecated methods/clases, use prepared statements here's the link to themysqli class

Azteca
  • 549
  • 6
  • 19