How to echo my users information in a profile page

Question

0.00/5 (No votes)

See more:

i am trying to create a user profile page,and what i want right is how to echo the users information from the database to display in a profile page once they login from the login page,but the problem is that will echo The user ID is not defined.ilease i need help anyone can help me fix my code am new to php and sql.

What I have tried:

profile.php

PHP

<?php
include('db.php');
?>
<!DOCTYPE html">
<html>
    <head>
        <title>Profile of an user</title>
    </head>
    <body>

        <div class="content">
<?php
//We check if the users ID is defined
if(isset($_GET['id']))
{
        $id = intval($_GET['id']);
        //We check if the user exists
        $sql = mysql_query('SELECT fst, las, uid, pass,sts,ocp FROM users WHERE id="'.$id.'"');
        if(mysql_num_rows($sql)>0)
        {
                $res = mysql_fetch_array($sql);
                //We display the user datas
?>
This is the profile of "<?php echo htmlentities($res['fst']); ?>" :
<table style="width:500px;">
        <tr>

        <td class="left"><h1><?php echo htmlentities($res['fst']); ?></h1>
        Email: <?php echo htmlentities($dnn['las']); ?><br />
        This user joined the website on <?php echo htmlentities($res['uid']); ?></td>
    </tr>
</table>
<?php
        }
        else
        {
                echo 'This user dont exists.';
        }
}
else
{
        echo 'The user ID is not defined.';
}
?>
                </div>
                 </body>
</html>

login.php

PHP

<?php
include 'db.php';

$uid = $_POST['uid'];
$pass = $_POST['pass'];



$sql = "SELECT * FROM users WHERE uid='$uid' AND pass='$pass'";
$result = mysqli_query($conn,$sql);

if($row = mysqli_fetch_assoc($result)){
   header("Location: profile.php");
   
}else{
     echo "invalid username or password";
}
?>

Posted 19-May-17 1:33am

Francis Chijioke

Updated 25-May-17 21:58pm

ChauhanAjay

v2

Add a Solution

Comments

Richard Deeming 26-May-17 11:27am

Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

Richard Deeming 26-May-17 11:28am

Also, never store passwords in plain text.

Secure Password Authentication Explained Simply[^]
Salted Password Hashing - Doing it Right[^]

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

**Nirav Prabtani** · Answer 1 · 2017-05-25T21:57:00

I dont know PHP but It seems you are not able to set id in profile.php

You can find id from login.php, Once user logged In successfully you have to pass id to profile.php then you can able to get profile detail of a particular user.

You should pass data like this from login.php

<?php
include 'db.php';
 
$uid = $_POST['uid'];
$pass = $_POST['pass'];
 

$sql = "SELECT * FROM users WHERE uid='$uid' AND pass='$pass'";
$result = mysqli_query($conn,$sql);
 
if($row = mysqli_fetch_assoc($result)){
   header("Location: profile.php?id=$rows[id]");
   
}else{
     echo "invalid username or password";
}
?>

I hope this is clear to you.