Sessions - creating user pages help!

liveluvlaughXD

I am in the process of making a blog where I have admin and regular members. I want them to login and in the admin section be able to see there posts and be able to add a new post. I started it but nothing is working and I know Im probably way off but I need help!

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>The Wacky Wahinis: The Blog, a collective diary and blog of the wacky wahinis!</title>
<link rel="stylesheet" type="text/css" href="demo.css" media="screen" />
<script language="javascript" type="text/javascript" src="tinymce/tiny_mce.js"></script>
<script language="javascript" type="text/javascript">
tinyMCE.init({
	theme : "advanced",
	mode : "textareas",
	theme_advanced_buttons1 : "bold,italic,underline,link,unlink,bullist,numlist,outdent,indent,forecolor,fullscreen,code",
   	theme_advanced_buttons2 : "",
    theme_advanced_buttons3 : "",
    theme_advanced_toolbar_location : "top",
    theme_advanced_toolbar_align : "left"
});
</script>
</head>

<body>
<?php

include ('config.php');

@mysql_connect($db_host, $db_user, $db_password) or die('not connected');

// Select the database
$dbc = @mysql_select_db($db_name) or die ('no database selected');

session_start();

	// Check if user is signed in
	if($_SESSION['user_id'])

	// Get user information
	$sql = "SELECT usr FROM tz_members WHERE user_id = '{$_GET['user']}'";
	$result = mysql_query($sql);
	$row = mysql_fetch_assoc($result);


	// Get status messages for that user
	$sql = "SELECT id, title, content FROM from blogData WHERE user_id = '{$_GET['user']}' ORDER BY statusdate DESC";
	$result = mysql_query($sql);
	while($row = mysql_fetch_array($result, MYSQL_ASSOC))
	{
		$posts[] = array(
			'id' = $row['id'],
			'title' = $row['title'],
			'content' = $row['content']
		);
	}


if(isset($_POST['submit'])){
$title= $_POST['title'];
$category = $_POST['category'];
$content = $_POST['content'];

mysql_query("INSERT INTO blogData('title', 'category', 'content') VALUE('$title', '$category', '$content'");													
				}

?>

MOD EDIT: [noparse]

..

[/noparse] bbcode tags changed to [noparse]

..

[/noparse] bbcode tags. Please use these (more appropriate) tags in the future!

anakadote

When you say nothing is working, what exactly isn't working? Do you get any errors, etc.?

A couple things I notice right off the bat:
1) When checking if the session user_id variable is set, you're not telling your script what to do either way.

// Check if user is signed in
if($_SESSION['user_id'])

// Maybe like this:
if(!isset($_SESSION['user_id'])){
  // Redirect to login page
  header("Location: login.php");
  exit();
}

2) When inserting information into a database from a form you should always escape the data to prevent attacks (i.e. use mysql_real_escape_string() )

liveluvlaughXD

I am getting errors.

Parse error: syntax error, unexpected '=', expecting ')' in /hermes/bosweb/web010/b104/ipw.interactive/public_html/ada388/ribe2/take2/admin.php on line 54

which line 54 is...

			$posts[] = array(
				'id' = $row['id'],
				'title' = $row['title'],
				'content' = $row['content']

anakadote

Close the array:

$posts[] = array(
  'id' = $row['id'],
  'title' = $row['title'],
  'content' = $row['content']
);

Also, just in case you didn't realize, you're creating a multidimensional array in this statement. "$posts[]" creates an array too, and you're putting your array() inside of it.

liveluvlaughXD

It actually is closed... i just didn't copy the whole thing.

I fixed what I thought wasn't working... but it still says the same thing saying that there should be a ( where there is a =... so im not sure

I attached the whole document this time...

<body>
<?php

include ('config.php');

@mysql_connect($db_host, $db_user, $db_password) or die('not connected');

// Select the database
$dbc = @mysql_select_db($db_name) or die ('no database selected');

session_start();


if($_SESSION['user_id'])

// Maybe like this:
if(!isset($_SESSION['user_id'])){
  // Redirect to login page
  header("Location: login.php");
  exit();
} 
		// Get user information
		$sql = "SELECT usr FROM tz_members WHERE user_id = '{$_GET['user']}'";
		$result = mysql_query($sql);
		$row = mysql_fetch_assoc($result);


	// Get status messages for that user
	$sql = "SELECT id, title, content FROM from blogData WHERE user_id = '{$_GET['user']}' ORDER BY statusdate DESC";
	$result = mysql_query($sql);
	while($row = mysql_fetch_array($result, MYSQL_ASSOC))
	{
		array(
			'id' = ($row['id']),
			'title' ($row['title']),
			'content' ($row['content'])
		);
	}


if(isset($_POST['submit'])){
$title= $_POST['title'];
$category = $_POST['category'];
$content = $_POST['content'];

mysql_query("INSERT INTO blogData('title', 'category', 'content') VALUE('$title', '$category', '$content'");													
				}

?>

<div class="container"><img src="wahinisnew.png" /> </div>
<div class="container"><h1> Add a new post</h1><br />

<form method="post" action="index.php?state=addpost">
<label for="title">Title:</label><br />
<input id="title" name="title" type="text" value="" /><br />
<label for="category">Category</label><br />
<input id="category" name="category" type="text" value="" /><br /> 
<label for="content">Content:</label><br />
<textarea id="content" name="content" rows="12" cols="60"></textarea><br />
<input name="submit" type="submit" value="submit" />
</form>
</div>

</body>

laserlight

liveluvlaughXD wrote:
It actually is closed... i just didn't copy the whole thing.

I fixed what I thought wasn't working... but it still says the same thing saying that there should be a ( where there is a =... so im not sure

I attached the whole document this time...

Ah, but now it looks like you wrote:

array(
    'id' = ($row['id']),
    'title' ($row['title']),
    'content' ($row['content'])
);

It should be:

$posts[] = array(
    'id' => $row['id'],
    'title' => $row['title'],
    'content' => $row['content']
);

Actually, you could simplify it to:

$posts[] = $row;

liveluvlaughXD

ok, so im making progress, its actually showing up now, but I am still getting a few errors showing up at the top, im not sure what they mean..

Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /hermes/bosweb/web010/b104/ipw.interactive/public_html/ada388/ribe2/take2/admin.php:6) in /hermes/bosweb/web010/b104/ipw.interactive/public_html/ada388/ribe2/take2/admin.php on line 31

Warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in /hermes/bosweb/web010/b104/ipw.interactive/public_html/ada388/ribe2/take2/admin.php on line 39

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /hermes/bosweb/web010/b104/ipw.interactive/public_html/ada388/ribe2/take2/admin.php on line 45

any ideas?

bradgrafelman

liveluvlaughXD;10950953 wrote:
any ideas?

Since HTTP headers can't be altered once they are sent, you must call session_start() before you output any data. As the error message states, you're outputting data on line #6, so either move session_start() above that output or remove that output.

EDIT: Just so we're clear on line numbers...

liveluvlaughXD wrote:
I attached the whole document this time...

Are you sure about that? The PHP error message you posted says that the call to session_start() occurred on line #31, yet in the code snippet you posted, it would appear that the call to session_start() is on line #11, meaning you omitted the first 10 lines of the document.