public/private profiles- id help

[dyr]

Hi folks, I had a working, editable profile but it wasn't visible to other users.  So I'm trying to make that conversion now.  Here's the current 'myprofile' code:

<?php

session_start();

include('config.php');
include('date.php');

$id = $_GET['id'];
$sql = mysql_query("SELECT * FROM members WHERE id = '$id' LIMIT 1");
$check = mysql_num_rows($sql);
$check = mysql_query($sql_user_verify) or die('Cannot Execute:'. mysql_error());

if ($check > 1)
	{
		echo "No one matches that id number!";
		exit();
	}


	if($check == 1)
	{
while($row = mysql_fetch_array($sql))
		{


$user = $id;


echo "<h2>Profile</h2>
<table>";

$row = mysql_fetch_array($sql);
echo "<tr><th>ID#:</th><td>".$user."</td></tr>
    <tr><th>Name: </th><td>".$row['callname']."</td></tr>
<tr><th>Email: </th><td>".$row['email']."</td></tr>
<tr><th>Password: </th><td><input type='password' value='".$row['password']."' disabled='true' /></td></tr>
<tr><th>Registered: </th><td>".$row['registered']."</td></tr>
    <tr><th>Last Login: </th><td>".$row['lastlogin']."</td></tr>";

echo "</table><br />";
  }
  
  if($id = $_SESSION['id'])
  {
  echo "<h2>Profile</h2>
<form method='post' action='editprofile.php'>
<table>";

$row = mysql_fetch_array($sql);
echo "<tr><th>ID#:</th><td>".$user."</td></tr>
    <tr><th>Name: </th><td>".$row['callname']."</td></tr>
<tr><th>Email: </th><td>".$row['email']."</td></tr>
<tr><th>Password: </th><td><input type='password' value='".$row['password']."' disabled='true' /></td></tr>
<tr><th>Registered: </th><td>".$row['registered']."</td></tr>
    <tr><th>Last Login: </th><td>".$row['lastlogin']."</td></tr>";

echo "</table><br />
<input type='submit' value='edit profile' />
</form>";
  }
  }
  
  else {
  die (); 
  }
?>
<?php

include('footer.php');

?>

 

Here's the link to the user's own profile:

<a href=myprofile.php?id='.$id.'>Profile</a>

 

And here's the edit profile link, which works fine:

<?php

include('config.php');
include('date.php');

if(isset($_POST['btnedit'])){
$callname = $_POST['callname'];
$email = $_POST['email'];
$password = $_POST['password'];

$sql = mysql_query( "UPDATE users SET callname='".$callname."', email='".$email."', password='".$password."' WHERE id='".$_SESSION['id']."'" );

if($sql){
echo "<script>alert('profile updated');window.location='myprofile.php'</script>";
}else{
echo "<script>alert('updating profile failed!');</script>";
}

}




$sql = mysql_query( "SELECT * FROM users WHERE id='".$_SESSION['id']."'" ); 
$row = mysql_fetch_array($sql);

$userfinal = $_SESSION['id'];

$user = $userfinal;

echo "<h2>Edit profile</h2>
<form method='post'>
<table><tr><th>ID#:</th><td>".$user."</td></tr>
<tr><th>Name:</th><td><input type='text' name='callname' value='".$row['callname']."'/></td></tr>
<tr><th>Email:</th><td><input type='text' name='email' value='".$row['email']."'/></td></tr>
<tr><th>Password:</th><td><input type='password' name='password' value='".$row['password']."'/></td></tr>
<tr><th>Registered:</th><td>".$row['registered']."</td></tr>
<tr><th>Last Login:</th><td>".$row['lastlogin']."</td></tr>
</table><br />
<input type='submit' name='btnedit' value='update' />
</form>";


?>
<?php

include('footer.php');

?>

 

It fails, it says the query was empty, even though there are user accounts created and information is being stored (as it worked fine before I tried editing the code to make it public.  What am I doing wrong?

[RickXu]

There's no $sql_user_verify defined anywhere unless it's included.

Might be an idea to turn on your error reporting for debugging purpose.

[dyr]

Thanks for the tip, RickXu.  So I got rid of that part and still get the same error:

Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given on line 10

 

line 10 is

$check = mysql_num_rows($sql);

 

So obviously that check failed, but I'm unsure as to why it failed?  What did I do wrong?

[NLT]

Thanks for the tip, RickXu.  So I got rid of that part and still get the same error:

Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given on line 10

 

line 10 is

$check = mysql_num_rows($sql);

 

So obviously that check failed, but I'm unsure as to why it failed?  What did I do wrong?

 

Add this to your page

error_reporting(E_ALL);

[dyr]

Ah, thank you!  So that's what RickXu meant by error reporting, I'm very new to php so haven't heard the term before.  I'm getting:

Notice: Undefined index: id in /Applications/XAMPP/xamppfiles/htdocs/testing/myprofile.php on line 10

 

But isn't the id variable defined?  Also I got rid of this error:

Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given on line 10, I made an error in the mysql query table.  However I'm still getting that the Id is undefined.

 

EDIT:

Okay so I tried now typing in a user's ID# (as this link: myprofile.php?id='.$id.' isn't working, it's supposed to lead them to their own profile), and it works!  Sort of... it displays the ID# of the user, however the rest of the information I called from the rows (call name, email, etc) isn't displaying.

[dyr]

I've edited the code to run some error checks.  Upon typing in the address: http://localhost/testing/myprofile.php?id=1 it says the ID not gotten from myprofile.php.  So where do I go from here?  I thought the ID could transfer over because of the sql entry?

 

<?php

include('config.php');
include('date.php');

error_reporting(E_ALL);

if(!empty($_GET['id'])) {
    echo "ID not gotten from myprofile.php";
} else {
    echo "ID Retreived";
    $id = $_GET['id'];
}

$sql = mysql_query("SELECT * FROM users WHERE id = '$id' LIMIT 1");

if(mysql_num_rows($sql) == 0) {
   echo "No one matches that id number!";
} else {
         while($row = mysql_fetch_array($sql)) {
   $user = $id;


echo "<h2>Profile</h2>
<table>";

$row = mysql_fetch_array($sql);
echo "<tr><th>ID#:</th><td>".$user."</td></tr>
    <tr><th>Name: </th><td>".$row['callname']."</td></tr>
<tr><th>Email: </th><td>".$row['email']."</td></tr>
<tr><th>Registered: </th><td>".$row['registered']."</td></tr>
    <tr><th>Last Login: </th><td>".$row['lastlogin']."</td></tr>";

echo "</table><br />";
  }
  
  if($id = $_SESSION['id'])
  {
  echo "<h2>Profile</h2>
<form method='post' action='editprofile.php'>
<table>";

$row = mysql_fetch_array($sql);
echo "<tr><th>ID#:</th><td>".$user."</td></tr>
    <tr><th>Name: </th><td>".$row['callname']."</td></tr>
<tr><th>Email: </th><td>".$row['email']."</td></tr>
<tr><th>Password: </th><td><input type='password' value='".$row['password']."' disabled='true' /></td></tr>
<tr><th>Registered: </th><td>".$row['registered']."</td></tr>
    <tr><th>Last Login: </th><td>".$row['lastlogin']."</td></tr>";

echo "</table><br />
<input type='submit' value='edit profile' />
</form>";
  }
  }
?>
<?php

include('footer.php');

?>

[RickXu]

if(!empty($_GET['id'])) {
    echo "ID not gotten from myprofile.php";
} else {
    echo "ID Retreived";
    $id = $_GET['id'];
}

 

This logic is wrong. Get rid of ! in the if statement and you should be good to go.

[dyr]

Ah, thanks.  My real question is all the information from the query isn't showing up in the profile like it should, in fact it's entirely blank except for the ID#. 

[RickXu]

while($row = mysql_fetch_array($sql)) {
   $user = $id;


echo "<h2>Profile</h2>
<table>";

 

The problem is here. You've got 2 fetches and the second one would return empty.

So if you get rid of the second $row = mysql_fetch_array($sql), it should all show up.

[dyr]

Thanks for all your help, RickXu.  The public profile now shows up great.  I think I'm doing something wrong php-wise with the private profile.  I'm trying to make it so that if the $id = the session ID (verifying the user ID# is the same ID# profile they're looking at), then the private profile is displayed, allowing them to edit their current information.  PHP manual to see the proper term to do this and can't find anything.

 

However it is showing up blank too.  Will I have to redo a mysql query to get the session ID's information?  Something like

$sql = mysql_query( "SELECT * FROM users WHERE id='".$_SESSION['id']."'" ); 

 

 

Anyway, thanks for taking the time to help out a newbie.  Here's the updated code:

<?php

include('config.php');
include('date.php');

error_reporting(E_ALL);

if(empty($_GET['id'])) {
    echo "ID not gotten from myprofile.php";
} else {
    echo "ID Retreived";
    $id = $_GET['id'];
}

$userfinal = $_GET['id'];

$user = $userfinal;

$sql = mysql_query("SELECT * FROM users WHERE id = '$id' LIMIT 1");

if(mysql_num_rows($sql) == 0) {
   echo "No one matches that id number!";
} else {
         while($row = mysql_fetch_array($sql)) {
   $user = $id;


echo "<h2>Profile</h2>
<table>";

echo "<tr><th>ID#:</th><td>".$user."</td></tr>
    <tr><th>Name: </th><td>".$row['callname']."</td></tr>
<tr><th>Email: </th><td>".$row['email']."</td></tr>
<tr><th>Registered: </th><td>".$row['registered']."</td></tr>
    <tr><th>Last Login: </th><td>".$row['lastlogin']."</td></tr>";

echo "</table><br />";
  }
  
  if($id = $_SESSION['id'])
  {
  echo "<h2>Profile</h2>
<form method='post' action='editprofile.php'>
<table>";


echo "<tr><th>ID#:</th><td>".$user."</td></tr>
    <tr><th>Name: </th><td>".$row['callname']."</td></tr>
<tr><th>Email: </th><td>".$row['email']."</td></tr>
<tr><th>Password: </th><td><input type='password' value='".$row['password']."' disabled='true' /></td></tr>
<tr><th>Registered: </th><td>".$row['registered']."</td></tr>
    <tr><th>Last Login: </th><td>".$row['lastlogin']."</td></tr>";

echo "</table><br />
<input type='submit' value='edit profile' />
</form>";
  }
  
else {

echo ""; }
  }
  
?>
<?php

include('footer.php');

?>

[RickXu]

$sql = mysql_query( "SELECT * FROM users WHERE id='".$_SESSION['id']."'" );

This is not quite to my eyes.

I'd suggest you use sprintf all the time as technically you don't need quotes for integers, only string needs quotes around.

 

So I'd write the query like this:

$query = sprintf("SELECT * FROM users WHERE id = %d", $_SESSION['id']);
$result = mysql_query($query, $conn) or die(mysql_error());

 

For references of sprintf, please see http://uk.php.net/manual/en/function.sprintf.php

It's my practice anyway.

[dyr]

Many thanks!  I got my code working fine now.  I have questions on how I can incorporate this in to my messaging system (ie having a users name linked to their profile) but I suppose I should start a new thread for that rather than posting here, yes?  I've tried meddling with it, will do so for a couple days now before asking for help.