join group button php&mysql

Question

I want to create button when I click it make 2 targets:
1. make this user join this group

(add user_id and gro_id in table groups_has_user)

2.change button value if user already join

CREATE TABLE IF NOT EXISTS `groups_has_user` (
          `Groups_gro_id` int(11) NOT NULL,
          `users_user_id` int(11) NOT NULL,
          PRIMARY KEY (`Groups_gro_id`,`users_user_id`),
          KEY `fk_Groups_has_users_users1_idx` (`users_user_id`),
          KEY `fk_Groups_has_users_Groups1_idx` (`Groups_gro_id`)
        ) ENGINE=InnoDB DEFAULT CHARSET=utf8;

<?php
  if(isset($_POST['join'])){
    require '_database/database.php';
    mysql_query("INSERT INTO groups_has_user(users_user_id, Groups_gro_id)VALUES('$users_user_id','$groid')");
  }
?>

<form action="group.php?gro=<?php echo $groid;?>" method="post" enctype="multipart/form-data" id="UploadForm">
  <button type="submit" class="btn btn-danger" name="join">join us</button>
</form>

Your code is vulnerable to [**SQL injection attacks**](https://en.wikipedia.org/wiki/SQL_injection). You should use [**mysqli**](https://secure.php.net/manual/en/mysqli.prepare.php) or [**PDO**](https://secure.php.net/manual/en/pdo.prepared-statements.php) prepared statements with bound parameters as described in [**this post**](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php). — Alex Howansky, Apr 15 '17 at 13:16
Stop using the `mysql_*` functions. They have been deprecated since v5.5 (Jun 2013) and removed since v7.0 (Dec 2015). Instead use the [**mysqli_***](https://secure.php.net/manual/en/book.mysqli.php) or [**PDO**](https://secure.php.net/manual/en/book.pdo.php) functions with [**prepared statements**](https://secure.php.net/manual/en/pdo.prepare.php) and [**bound parameters**](https://secure.php.net/manual/en/pdostatement.bindparam.php). — Alex Howansky, Apr 15 '17 at 13:16
This is small final exam project my friend need it with mysql not mysqli because his instructor want this — D2rkZ3r0, Apr 15 '17 at 13:38

score 0 · Accepted Answer · answered Apr 15 '17 at 16:02

Well, a lazy solution...

When you insert the data into mysql store the user_id in session. like

<?php
  if(isset($_POST['join'])){
    require '_database/database.php';
    $_SESSION['user_id'] = $users_user_id;
    mysql_query("INSERT INTO groups_has_user(users_user_id, groups_gro_id)VALUES('$users_user_id','$groid')");
  }
?>

Now check the user if he has joined or not.

<?php 
    $result = mysql_query("SELECT * FROM groups_has_user WHERE users_user_id = $_SESSION['user_id']");
if(isset($result)){
?>
<h3>You have joined this group</h3>
<?php
    }else{
?>
    <form action="group.php?gro=<?php echo $groid;?>" method="post" enctype="multipart/form-data" id="UploadForm">
          <button type="submit" class="btn btn-danger" name="join">join us</button>
    </form>
<?php
    }
?>

I hope you got the idea of how to check user. Now, you go ahead from here.

PS: Please be concerned about SQL INJECTIONs. Use mysqli and prepared statements

join group button php&mysql

1 Answers1