0

I read many topics about this problem but i cant find the answer

I want create a page for each user who he can see their info in that page. Like profile page.

This is my table:

Table

My session file (db.php):

<?php 
session_start();
header('Content-Type: text/html; charset=UTF-8');
require ("../functions.php"); 
  mysql_connect($dbHOST, $dbUSER, $dbPASS);
  mysql_select_db($dbNAME); 
function user_login ($username, $password) { 
  $username = mysql_real_escape_string($username); 
  $password = md5($password);
  $result = mysql_query("SELECT * FROM users WHERE username = '".$username."' AND password = '".$password."' AND usergroup = '1'"); 
  $exists = (mysql_num_rows($result))?TRUE:FALSE;
  if (!$exists){ 
      echo "نام کاربری/رمز عبور اشتباه است و یا شما مجوز دسترسی به این بخش را ندارید!"; 
    }
 else { 
     $_SESSION['username'] = true;
 echo "<script language=\"Javascript\">document.location.href='index.php' ;</script>";
} 
}
?>

Login page (login.php):

<?php 
header('Content-Type: text/html; charset=UTF-8');
require ("../functions.php"); 
include("db.php"); 
if(isset($_POST['username']) && isset($_POST['password'])){   
    user_login($_POST['username'], $_POST['password']); 
} 
?>
<!DOCTYPE html>
<html lang="en">
<head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <meta name="author" content="Alireza Behnamnik | T!G3R" />
   <title> پنل مدیریت </title>
  <link rel="stylesheet" type="text/css" href="../css/bootstrap.css">
  <link rel="stylesheet" type="text/css" href="../css/font-awesome.css">
  <link rel="stylesheet" type="text/css" href="../css/style.css">
  <script type="text/javascript" src="../js/jquery-3.1.1.js"></script>
  <script type="text/javascript" src="../js/bootstrap.min.js"></script>
   <!-- Other -->
   <link rel="icon" href="<?php echo $favicon ?>" />
</head>
<body>
<style>
body {background:#e9e9e9;}
</style>
<div class="container-fluid">
 <div class="row">
 <div class="tnbar">
 <a href="../index.html" target="_blank"><button class="btn pannel btn-default navbar-btn pull-left">صفحه اصلی</button></a>
 <span class="pull-right"> پنل مدیریت وبسایت <?php echo $sitetitle ?> </span>
 </div>
</div>
</div>
  <div class="col-md-4 forms">
  <p class="adtitle"> ورود به حساب مدیریت</p>
  <form action="login.php" method="post">
     <div class="col-md-12"><input class="form-control" name="username" type="text" placeholder="نام کاربری" required/></div></br></br>
     <div class="col-md-12"><input class="form-control" name="password" type="password" placeholder="رمز عبور" required/></div></br></br>
    <button style="color:#000;">ورود به حساب</button>
  </form>
  </div>
</body>
</html>

functions.php is used for database information.

Now for example i want to show the user information in user.php page

Alireza Behnamnik
  • 206
  • 1
  • 3
  • 18
  • *Please*, stop using string concatenation and start [**using parameterized queries**!](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php). Your code is just begging for [Bobby Tables](http://bobby-tables.com/) to come take a visit. – Siyual Feb 01 '17 at 16:51
  • `password varchar 255` and using `md5` which is only 32. I take it you plan on using `password_hash()` later on? I sure hope you do because you **will** get hacked if you're live or intending to go live with this. – Funk Forty Niner Feb 01 '17 at 16:51
  • 1
    you **MUST NOT** use `mysql_xxx` functions which are deprecated since php5.5 (more than 3 years ago) and removed since PHP7 because of security issues (see http://stackoverflow.com/q/12859942/3992945). Please use `mysqli_xxx` or `PDO` instead php.net/manual/en/mysqlinfo.api.choosing.php. – ᴄʀᴏᴢᴇᴛ Feb 01 '17 at 16:51
  • hmm , ok , thank you all , ill do it :D – Alireza Behnamnik Feb 01 '17 at 16:53

1 Answers1

0

Put something like that at the end of your function (before the two } at the end of the code)

$lId=mysql_result($result, 0, "id" );
$lusername=mysql_result($result, 0, "username" );
echo "User $li is $lusername";

but you are using deprecated mysql_* functions and your mysql query can be attacked by sql injection threats.

Community
  • 1
  • 1
Laurent PELE
  • 487
  • 3
  • 9