Table row only visible for certain users

Php_Newb

Hey everyone,
I have been struggling with this code for a little while. I want my code to display the source field from my inventoryTable to a user that is subscribed in my users table. I am using an if statement but the statement always return that false statement. I believe I am doing my query select incorrectly. I was wondering if anyone could give me a hint at what I might be doing wrong with my code.

<?php
$db = mysql_connect("localhost", "", "");
mysql_select_db("",$db);
$result = mysql_query("SELECT * FROM inventoryTable",$db);
$query="select sub from users where sub = 'yes'";
$id=mysql_query($query);
echo "<TABLE style=\"background-color: #FFFFFF; border: 10px solid A4A4A4;\">";
echo"<TR><TD><B>Title</B>
<TD><B>Authors First Name</B>
<TD><B>Authors Last Name</B>
<TD><B>ISBN</B><TD>
<B>Publisher</B>
<TD><B>Course Number</B>
<TD><B>Source</B></TR>";
while ($myrow = mysql_fetch_array($result))
{
echo "<TR><TD>".$myrow["title"].
"<TD>".$myrow["authorsFirst"].
"<TD>".$myrow["authorsLast"].
"<TD>".$myrow["ISBN"].
"<TD>".$myrow["publisher"].
"<TD>".$myrow["courseNum"];
If($_SESSION['username']== '$id')
{"<td>".$myrow["source"];
} else {
	echo "<TD>"."Please subscribe to View";
}
echo "</TABLE>";

}
?>

barand

$id is a result set from the query, not the value of "sub" data column from the table. You need to fetch the retrieved row.

And stop using mysql* functions; they have been removed from current php version. Use mysqli or PDO functions.

dalecosp

barand;11054631 wrote:
$id is a result set from the query, not the value of "sub" data column from the table. You need to fetch the retrieved row.

And stop using mysql* functions; they have been removed from current php version. Use mysqli or PDO functions.

Good idea 🙂

Php_Newb;11054621 wrote:
Hey everyone,
I have been struggling with this code for a little while. I want my code to display the source field from my inventoryTable to a user that is subscribed in my users table. I am using an if statement but the statement always return that false statement. I believe I am doing my query select incorrectly. I was wondering if anyone could give me a hint at what I might be doing wrong with my code.

For some reason I'm feeling magnanimous today:

<?php

//converted to "mysqli"
$db = mysqli_connect("localhost", "", "","database_name"); //mysql_connect("localhost", "", "");
//mysql_select_db("",$db); //omit this, it's contained above

// Hmm ... you don't do anything with this right away.  That's OK, I guess.  (I'd save and do it later).
$result = $db->query("SELECT * FROM inventoryTable"); //mysql_query("SELECT * FROM inventoryTable",$db);

$query="select sub from users where sub = 'yes'"; //does this only return one record?

//Hmm.  the "query" function returns a *resource* ... not the data itself.
$result2 = $db->query($query);//$id=mysql_query($query);

if ($result2 && $result2->num_rows) //if we have a resource, and at least one row of data to return ...
{
    $row = $result2->fetch_assoc(); //ask for the row of data
    $id = $row['sub']; // that *should* be the id from the DB
} else {
    //here you should *gracefully* handle the fact that you haven't got a user ID ... 
    die("Login, you turkey!");
}

//Hmm. Tables?  Well, I guess.  

echo "<TABLE style=\"background-color: #FFFFFF; border: 10px solid A4A4A4;\">";
echo"<TR><TD><B>Title</B>
<TD><B>Authors First Name</B>
<TD><B>Authors Last Name</B>
<TD><B>ISBN</B><TD>
<B>Publisher</B>
<TD><B>Course Number</B>
<TD><B>Source</B></TR>";

while ($myrow = $result->fetch_assoc())
{
    echo "<TR><TD>".$myrow["title"].
"<TD>".$myrow["authorsFirst"].
"<TD>".$myrow["authorsLast"].
"<TD>".$myrow["ISBN"].
"<TD>".$myrow["publisher"].
"<TD>".$myrow["courseNum"];

if($_SESSION['username']== '$id') // hmm, is $id a username, then?  Maybe the var should be named "$un"?
{
    // I added the closing HTML tags
    "<td>".$myrow["source"]."</td></tr>";
}
else
{
    // I added the closing HTML tags
echo "<TD>"."Please subscribe to View</td></tr>";
}
}
echo "</TABLE>";
?>

Php_Newb

I will be switching to mysqli very soon. I am on a time crunch and mysql was the only thing I was taught last year. Am I on the right track with this?

<?php
$db = mysql_connect("localhost", "", "");
mysql_select_db("",$db);
$result = mysql_query("SELECT * FROM inventoryTable",$db);
$subResult = "select sub from users where sub = 'yes'";
echo "<TABLE style=\"background-color: #FFFFFF; border: 10px solid A4A4A4;\">";
echo"<TR><TD><B>Title</B>
<TD><B>Authors First Name</B>
<TD><B>Authors Last Name</B>
<TD><B>ISBN</B><TD>
<B>Publisher</B>
<TD><B>Course Number</B>
<TD><B>Source</B></TR>";
while ($myrow = mysql_fetch_array($resultResult))
{
echo "<TR><TD>".$myrow["title"].
"<TD>".$myrow["authorsFirst"].
"<TD>".$myrow["authorsLast"].
"<TD>".$myrow["ISBN"].
"<TD>".$myrow["publisher"].
"<TD>".$myrow["courseNum"];
	while ($id = mysql_fetch_row($sub)) 
		{
			If($_SESSION['username']== '$id')
				{"<td>".$myrow["source"];
			} else {
				echo "<TD>"."Please subscribe to View";
			}
		}
	echo "</TABLE>";

}
?>

Php_Newb

Thanks for the information and the notes. I am still getting "Please subscribe to View" for the user that has yes in the sub field. Here is the users table

| Field     | Type        | Null | Key | Default | Extra          |
+-----------+-------------+------+-----+---------+----------------+
| user_id   | int(11)     | NO   | PRI | NULL    | auto_increment | 
| username  | varchar(50) | YES  |     | NULL    |                | 
| password  | varchar(50) | YES  |     | NULL    |                | 
| email     | varchar(50) | YES  |     | NULL    |                | 
| city      | varchar(50) | YES  |     | NULL    |                | 
| state     | varchar(2)  | YES  |     | NULL    |                | 
| zip       | varchar(15) | YES  |     | NULL    |                | 
| phone     | varchar(15) | YES  |     | NULL    |                | 
| firstName | varchar(50) | YES  |     | NULL    |                | 
| lastName  | varchar(50) | YES  |     | NULL    |                | 
| sub       | varchar(5)  | YES  |     | NULL    |                |

  if($_SESSION['username']== '$id') // hmm, is $id a username, then?  Maybe the var should be "$un"?

I changed the variable to just in case $id was messing up the code.

dalecosp

Perhaps. It's still outputting broken HTML (no ending tags on table cells/rows). There's a typo(?) in mysql_fetch_array($resultResult)?

You use mysql_fetch_row($sub) ... did you mean $subResult?

GIGO ... you must be careful with these sorts of things.

And here:

    while ($id = mysql_fetch_row($sub))  

        { 
            If($_SESSION['username']== '$id')

$id will be array-like, so you'll want to compare $_SESSION['username'] to $id[0], I think.

Php_Newb

Would I use something like this to fetch the results to see if the sub field has yes inside of it?

while ($myrow = $result2->fetch_assoc())
{ 
if($_SESSION['username']== '$sub')

Sorry for all the questions and thank you very much for the notes. I am trying to wrap my head around everything in a short time.

dalecosp

//this is the query's SQL statement
$query="select sub from users where sub = 'yes'"; 

//this is *hopefully* a result object returned from asking the RDBMS for the result of that statement
$result2 = $db->query($query);

//this will successively place a row of data, keyed by the SQL column names, into $myrow
while ($myrow = $result2->fetch_assoc())

//You would then want to compare with what?  maybe the DB design is funny...?

So, what are you trying to do exactly? Does the page know the user's ID? You're looking to see if there's a "Y" in the sub column that corresponds to the user_id of the current user? Where do you do your session logic? Perhaps the session should note if the user is a subscriber ... then you'd just test that variable 😉

Php_Newb

Yes the page is only viewable by a session user.
This is on the top of my page.

session_start();
$username=$_SESSION['username'];

I am trying to have

"<td>".$myrow["source"]."</td></tr>";

from the inventory Table only viewable by a user who has 'yes' in their sub field instead of null. If the user doesn't have 'yes' in their sub field then I would like the that user to see

echo "<TD>"."Please subscribe to View</td></tr>";

dalecosp

OK, so at the top:

session_start();
$username=$_SESSION['username'];
$_SESSION['subscriber'] = some_function_here();

Then all you need to do is check for that variable when you want to decide what HTML to display.

Php_Newb

Would the function that goes with

$_SESSION['subscriber'] = some_function_here()

;
be similar to

$query="select sub from users where sub = 'yes'";
$result2 = $db->query($query);

The code basically checks to see if the session use is a subscribe. Once the session is good I could just use the if statement to see if

If($_SESSION['username']== 'subscriber'

Hopefully I am on the right track

dalecosp

Perhaps so. Normally it would return a boolean which would be assigned to the $SESSION variable that you want to track. How you get this is what you're talking about, a DB query that would return 1 or 0 (or Y/N, or T/F, or something like that) depending on whether the user is a "subscriber" (whatever that is). In that case, it might be something like:

if )$_SESSION['subscriber']) {
   //print the source link
} else {
   echo "You must be subscribed to view this data.";
}

Typically, a $_SESSION instance might contain anything you'd wish to know about a user in order to do "user stuff" on a page ... like determine the login status (T/F, a boolean), print their username (a string), determine if they're a subscriber (another boolean), etc.

On our site, for example, a "user object" contains the integer $user_id, the strings $username and $firstname, the boolean $is_logged_in, the cookie data $cookie, an array of alphanumeric $access_codes, and an integer $shoplist_count that tells how many shopping lists they have products in. That's a little over your head in terms of coding, maybe, right now, but we're trying to think broadly about what a site does, and somewhat more specifically about how it does it ....

Php_Newb

Oh I see..... When the page loads the session checks to see if there is a Yes in the table. Then when I need to check it in the html I just need to is an if statement with the $session.
I know this isn't correct. I am messing around with the code now.

$_SESSION['subscriber'] =  

$check="select sub from users where sub=yes";
$subResult=$db->query($check);
$row= mysqli_fetch_assoc($subResult);

	If($_SESSION['subscriber'])
		{"<td>".$myrow["source"];
			} else {
				echo "<TD>"."Please subscribe to View";
			}

pbismad

In case the OP is still working on this. Here are some hints that will make writing, testing, and debugging your code easier -

1) You need to have php's error_reporting set to E_ALL and display_errors set to ON (preferably in the php.ini on your development system) so that php will help you by reporting and displaying all the errors it detects.

2) You should separate your database dependent code from the presentation code that's producing output. While this sounds like an advanced technique, it's not. If a database query is expected to match only one row (such as retrieving user specific information), fetch the one row into a variable. If the database query is expected to match one or more rows, fetch the data into an array variable. Doing this will both clean up your code and make it easier to debug problems. You can verify that the query(ies) are fetching the correct data by using php's print_r() or var_dump() on the variables holding the data. Doing this will also help with the design of your code and queries, since it will force you to define what data you expect each query to retrieve, before you write any query or code using that data.

3) Your login system should store the user_id in the session variable. This will make any use of this information safer (if the username is allowed to contain punctuation characters and you are not safely supplying data values to sql query statements, a username could be crafted that allows sql injection) and faster. On any page request, if there is a logged in user, you would query for and retrieve the user information. This would not be stored in a session variable so that any changes made to the values will take effect without having to re-login to update the contents of the session variables. Your query against the users table would need a WHERE clause so that it matches the correct row. Your current query doesn't contain anything that will match a specific row and assuming you eventually fetch a row from the result of that query, will only get the first row present in the table with the current sql query.