CODEWITHSUNDEEP
php
Steven
Steven

Reputation: 17

How to show data from database only from currently logged user?

I want to show data from database to only currently logged user. So for example, if I want to show him when did he created his account, how can I show him only this value? And I mean this value of only his account. Not all. I tried

<?php    
$dbhost = '';
$dbuser = '';
$dbpass = '';
$conn = mysql_connect($dbhost, $dbuser, $dbpass);
if(! $conn )
{
  die('Could not connect: ' . mysql_error());
}
$sql = "Select date from members"

mysql_select_db('');
$retval = mysql_query( $sql, $conn );
if(! $retval )
{
  die('Could not get data: ' . mysql_error());
}
while($row = mysql_fetch_array($retval, MYSQL_ASSOC))
{
      echo "{$row['date']}  <p> ";
} 
?>

But this shows ALL dates from that table. I want to show date of currently logged user only. Thanks EDIT : Users log in with email and pass (which is hashed) Here is my function for login

function login($email, $password, $mysqli) {
    // Using prepared statements means that SQL injection is not possible. 
    if ($stmt = $mysqli->prepare("SELECT id, username, password, salt 
        FROM members
       WHERE email = ?
        LIMIT 1")) {
        $stmt->bind_param('s', $email);  // Bind "$email" to parameter.
        $stmt->execute();    // Execute the prepared query.
        $stmt->store_result();

        // get variables from result.
        $stmt->bind_result($user_id, $username, $db_password, $salt);
        $stmt->fetch();

        // hash the password with the unique salt.
        $password = hash('sha512', $password . $salt);
        if ($stmt->num_rows == 1) {
            // If the user exists we check if the account is locked
            // from too many login attempts 

            if (checkbrute($user_id, $mysqli) == true) {
                // Account is locked 
                // Send an email to user saying their account is locked
                return false;
            } else {
                // Check if the password in the database matches
                // the password the user submitted.
                if ($db_password == $password) {
                    // Password is correct!
                    // Get the user-agent string of the user.
                    $user_browser = $_SERVER['HTTP_USER_AGENT'];
                    // XSS protection as we might print this value
                    $user_id = preg_replace("/[^0-9]+/", "", $user_id);
                    $_SESSION['user_id'] = $user_id;
                    // XSS protection as we might print this value
                    $username = preg_replace("/[^a-zA-Z0-9_\-]+/", 
                                                                "", 
                                                                $username);
                    $_SESSION['username'] = $username;
            $_SESSION['email'] = $email;
                    $_SESSION['login_string'] = hash('sha512', 
                              $password . $user_browser);
                    // Login successful.
                    return true;
                } else {
                    // Password is not correct
                    // We record this attempt in the database
                    $now = time();
                    $mysqli->query("INSERT INTO login_attempts(user_id, time)
                                    VALUES ('$user_id', '$now')");
                    return false;
                }
            }
        } else {
            // No user exists.
            return false;
        }
    }
}

Upvotes: 0

Views: 1812

Answers (1)

Philip
Philip

Reputation: 2988

Use a the WHERE column='value' code at the end of your SQL (see: http://www.tizag.com/mysqlTutorial/mysqlwhere.php)

Example:

If you know the user's ID that is used in your database, store that in a variable (here called $usersIDnr).

Then use the columns name (userID for example) to use in the following code at the end of your SQL:

WHERE userID='$usersIDnr'

Upvotes: 1

Related Questions