Display Users Information with MySQL and PHP

Question

I am having problems displaying my users information that they inputted at sign up once they have logged in again. Once I sign up the information will be displayed properly on my account page but when I log out and log back in the information disappears. How can I access the information for when my users login?

This is my user sign up.

<?php

include 'global_settings.php';

function NewUser() { 
    $firstName = $_POST['firstName'];
    $lastName = $_POST['lastName'];  
    $email = $_POST['email']; 
    $username = $_POST['username'];
    $password = $_POST['password'];
    $query = "INSERT INTO userlogin (firstName, lastName, email, username, password) VALUES ('$firstName', '$lastName', '$email', '$username', '$password')"; 
    $data = mysql_query ($query)or die(mysql_error()); 
    if($data) { 
        session_start();
        $_SESSION["firstName"] = $firstName;
        $_SESSION["lastName"] = $lastName;
        $_SESSION["userName"] = $username;
        $_SESSION["email"] = $email;
        header("Location: ../chooseyoursport.php");
    } 
}
NewUser();

function SignUp() { 
    if(!empty($_POST['username'])){ //checking the 'user' name which is from Sign-Up.html, is it empty or have some text 
        $query = mysql_query("SELECT * FROM userlogin WHERE Username = $username AND Password = $password") or die(mysql_error()); 
        if(!$row = mysql_fetch_array($query) or die(mysql_error())) { 
            newuser(); 
        } else { 
            echo "SORRY...YOU ARE ALREADY REGISTERED USER..."; 
        } 
    } 
} 
if(isset($_POST['submit'])) { 
    SignUp(); 
}
?>

This is my user login.

<?php
    error_reporting(0);
    session_start();
    include 'global_settings.php';

    //Convert POST to normal variables
    $password = $_POST['password'];
    $username = $_POST['username'];

    $sql = mysql_query("SELECT * FROM userlogin WHERE Username='$username' AND Password='$password'");
    $login_check = mysql_num_rows($sql);

    // if login_check is greater than 0 then it will register a session (meaning if the user exists username and password are both correct)

    if($login_check > 0){
        while($row = mysql_fetch_array($sql)){
            foreach( $row AS $key => $val){
                $$key = stripslashes($val);
            }
            session_start();
            $_SESSION["firstName"] = $firstName;
            $_SESSION["lastName"] = $lastName;
            $_SESSION["userName"] = $username;
            $_SESSION["email"] = $email;
            header("Location: ../chooseyoursport.php");
            //echo "It worked";
        }
    } else {
        echo "You could not be logged in! Either your username or password is incorrect <br> Please try again!";
    }


?>

sincerely doubting your user sign up code works. Not with those missing quotes in the query `WHERE Username = $username AND Password = $password")` — Funk Forty Niner, Dec 11 '15 at 18:03
[Your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — Jay Blanchard, Dec 11 '15 at 18:04
Please [stop using `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php). [These extensions](http://php.net/manual/en/migration70.removed-exts-sapis.php) have been removed in PHP 7. Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [PDO](http://php.net/manual/en/pdo.prepared-statements.php) and [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and consider using PDO, [it's really pretty easy](http://jayblanchard.net/demystifying_php_pdo.html). — Jay Blanchard, Dec 11 '15 at 18:04
Please use PHP's [built-in functions](http://jayblanchard.net/proper_password_hashing_with_PHP.html) to handle password security. If you're using a PHP version less than 5.5 you can use the `password_hash()` [compatibility pack](https://github.com/ircmaxell/password_compat). — Jay Blanchard, Dec 11 '15 at 18:04

Sergey Belyakov · Answer 1 · 2015-12-11T18:29:59.697

1) $$key = stripslashes($val); Double $$

2) Data which you are putting into $_SESSION is empty;

3) session_start(); 2 times in one program's space

4) And everything else that the guys have said above

        foreach( $row AS $key => $val){
            $$key = stripslashes($val);
        }
        session_start();
        $_SESSION["firstName"] = $firstName;
        $_SESSION["lastName"] = $lastName;
        $_SESSION["userName"] = $username;
        $_SESSION["email"] = $email;
        header("Location: ../chooseyoursport.php");

Display Users Information with MySQL and PHP

1 Answers1