<?php
session_start();
function fetch_users (){
$result = mysql_query('SELECT `uid` AS `id`, `username` AS `username` FROM `users`');
$users = array();
while (($row = mysql_fetch_assoc($result)) != false){
$users[] = $row;
}
return $users;
}
function fetch_user_info($uid){
$uid = (int)$uid;
$sql = "SELECT
`username` AS `username`,
`grad` AS `grad`,
`drzava` AS `drzava`,
`fan` AS `fan`,
`Website` AS `Website`
FROM users
WHERE `uid` = '$uid'";
$result = mysql_query($sql);
return mysql_fetch_assoc($result);
}
function set_profile_info($username, $grad, $drzava, $fan, $website){
$username = mysql_real_escape_string(htmlentities($username));
$grad = mysql_real_escape_string(htmlentities($grad));
$drzava = mysql_real_escape_string(htmlentities($drzava));
$fan = mysql_real_escape_string(htmlentities($fan));
$website = mysql_real_escape_string(htmlentities($website));
$uid = $_SESSION['uid'];
mysql_query("UPDATE `users` SET `username` = `$username`, `grad` = `$grad`, `drzava` = `$drzava`,`fan` = `$fan`, `website` = `$website` WHERE `uid`=`$uid`");
}
?>
init.inc.php<?php
session_start();
$dbhost = "mysql14.000webhost.com"; // this will ususally be 'localhost', but can sometimes differ
$dbname = "myname"; // the name of the database that you are going to use for this project
$dbuser = "myuser"; // the username that you created, or were given, to access your database
$dbpass = "mypass"; // the password that you created, or were given, to access your database
mysql_connect($dbhost, $dbuser, $dbpass) or die("MySQL Error: " . mysql_error());
mysql_select_db($dbname) or die("MySQL Error: " . mysql_error());
$path = dirname (__FILE__);
include "$path/inc/user.inc.php";
$_SESSION ['uid'] = 1;
?> <?php
if(!empty($_SESSION['LoggedIn']) && !empty($_SESSION['Username']))
{
When they are logged in they can see the page. <?php
if(!empty($_SESSION['LoggedIn']) && !empty($_SESSION['Username']))
{
?>
<?php
}
elseif(!empty($_POST['username']) && !empty($_POST['password']))
{
$username = mysql_real_escape_string($_POST['username']);
$password = md5(mysql_real_escape_string($_POST['password']));
$checklogin = mysql_query("SELECT * FROM users WHERE Username = '".$username."' AND Password = '".$password."'");
if(mysql_num_rows($checklogin) == 1)
{
$row = mysql_fetch_array($checklogin);
$_SESSION['Username'] = $username;
$_SESSION['LoggedIn'] = 1;
echo "<h1><center>Success</center></h1>";
echo "<p><center>We are now redirecting you to the member area.</center></p>";
echo "<meta http-equiv='refresh' content='=2;user.php' />";
}
else
{
echo "<h1>Error</h1>";
echo "<p>Sorry, your account could not be found. Please <a href=\"user.php\">click here to try again</a>.</p>";
}
}
else
{
?>
<?php
}
?>
if(mysql_num_rows($checklogin) == 1)
{
$row = mysql_fetch_array($checklogin);
$_SESSION['Username'] = $username;
$_SESSION['LoggedIn'] = 1;
echo "<h1><center>Success</center></h1>";
echo "<p><center>We are now redirecting you to the member area.</center></p>";
echo "<meta http-equiv='refresh' content='=2;user.php' />";
}
The above is where you are setting your $_SESSION variables. Add a new line above $_SESSION['Username'] with the following:
$_SESSION['uid'] = $row['uid'];If your column in the database is not uid change $row['uid'] to $row['your column name']
if (empty($errors)){
$grad = htmlentities($_POST['grad']);
$drzava = htmlentities($_POST['drzava']);
$fan = htmlentities($_POST['fan']);
$website = htmlentities($_POST['website']);
$user_info = array();
$user_info['grad'] = "$grad";
$user_info['drzava'] = "$drzava";
$user_info['fan'] = "$fan";
$user_info['website'] = "$website";
}else{
$user_info = fetch_user_info($_SESSION['uid']);
}
?>
<?php
mysql_query("UPDATE `users` SET `grad` = '{$grad}', `drzava` = '{$drzava}',`fan` = '{$fan}', `website` = '{$website}' WHERE `uid`='{$uid}'");
?>
Move your query so that it looks like this:
if (empty($errors)){
$grad = htmlentities($_POST['grad']);
$drzava = htmlentities($_POST['drzava']);
$fan = htmlentities($_POST['fan']);
$website = htmlentities($_POST['website']);
mysql_query("UPDATE `users` SET `grad` = '{$grad}', `drzava` = '{$drzava}',`fan` = '{$fan}', `website` = '{$website}' WHERE `uid`='{$uid}'");
$user_info = array();
$user_info['grad'] = "$grad";
$user_info['drzava'] = "$drzava";
$user_info['fan'] = "$fan";
$user_info['website'] = "$website";
}else{
$user_info = fetch_user_info($_SESSION['uid']);
}
?> <?php
session_start();
include('core/init.inc.php');
if(isset($_POST['username'])){
$errors = array();
}
if(isset($_POST['grad'])){
$errors = array();
}
if(isset($_POST['drzava'])){
$errors = array();
}
if(isset($_POST['fan'])){
$errors = array();
}
if(isset($_POST['website'])){
$errors = array();
}
if (empty($errors)){
$grad = htmlentities($_POST['grad']);
$drzava = htmlentities($_POST['drzava']);
$fan = htmlentities($_POST['fan']);
$website = htmlentities($_POST['website']);
mysql_query("UPDATE `users` SET `grad` = '{$grad}', `drzava` = '{$drzava}',`fan` = '{$fan}', `website` = '{$website}' WHERE `uid`='{$uid}'");
$user_info = array();
$user_info['grad'] = "$grad";
$user_info['drzava'] = "$drzava";
$user_info['fan'] = "$fan";
$user_info['website'] = "$website";
}else{
$user_info = fetch_user_info($_SESSION['uid']);
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-type" content="text/html; charset=utf-8" />
<title>Global Betting</title>
</head>
<body>
<div>
<?php
if (isset($errors) ==false){
echo 'Click update to edit your profile.';
}else if (empty($errors)){
echo 'Your profile has been updated!';
}else{
echo '<ul><li>'. implode('</li><li>'. $errors). '</li></ul>';
}
?>
<?php
if(!empty($_SESSION['LoggedIn']) && !empty($_SESSION['Username']) && !empty($_SESSION['uid']))
{
?>
</div>
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method ="POST">
<div>
<label for="grad">Username</label>
<input type="text" name="username" id="username" value="<?php echo $user_info ['username']; ?>" />
</div><div>
<label for="grad">Grad</label>
<input type="text" name="grad" id="grad" value="<?php echo $user_info['grad']; ?>" />
</div>
<div>
<label for="drzava">Drzava</label>
<input type="text" name="drzava" id="drzava" value="<?php echo $user_info ['drzava']; ?>" />
</div>
<div>
<label for="fan">Fan</label>
<input type="text" name="fan" id="fan" value="<?php echo $user_info ['fan']; ?>" />
</div>
<div>
<label for="grad">Website</label>
<input type="text" name="website" id="website" value="<?php echo $user_info ['website']; ?>" />
</div>
<div>
<input type="submit" value="Update" />
</div>
</form>
</body>
</html>
<?php
}
elseif(!empty($_POST['username']) && !empty($_POST['password']))
{
$username = mysql_real_escape_string($_POST['username']);
$password = md5(mysql_real_escape_string($_POST['password']));
$checklogin = mysql_query("SELECT * FROM users WHERE username = '".$username."' AND password = '".$password."'");
if(mysql_num_rows($checklogin) == 1)
{
$row = mysql_fetch_array($checklogin);
$_SESSION['Username'] = $username;
$_SESSION['LoggedIn'] = 1;
$_SESSION['uid'] = $row['uid'];
echo "<h1><center>Success</center></h1>";
echo "<p><center>We are now redirecting you to the member area.</center></p>";
echo "<meta http-equiv='refresh' content='=2;user.php' />";
}
else
{
echo "<h1>Error</h1>";
echo "<p>Sorry, your account could not be found. Please <a href=\"user.php\">click here to try again</a>.</p>";
}
}
else
{
?>
<?php
}
?>