pulling user data after login

[paddy_fields]

I've implemented a login script, and now want to pull all of the rows of data related to the user to display on the page once they have logged in successfully.

 

This is the function that logs the user in...

function login($email, $password, $db) {
    // Using prepared statements means that SQL injection is not possible. 
    if ($stmt = $db->prepare("SELECT id, username, password, salt 
				  FROM members 
                                  WHERE email = ? LIMIT 1")) {
        $stmt->bind_param('s', $email);  // Bind "$email" to parameter.
        $stmt->execute();    // Execute the prepared query.
        $stmt->store_result();

        // get variables from result.
        $stmt->bind_result($user_id, $username, $db_password, $salt);
        $stmt->fetch();

        // hash the password with the unique salt.
        $password = hash('sha512', $password . $salt);
        if ($stmt->num_rows == 1) {
            // If the user exists we check if the account is locked
            // from too many login attempts 
            if (checkbrute($user_id, $db) == true) {
                // Account is locked 
                // Send an email to user saying their account is locked 
                return false;
            } else {
                // Check if the password in the database matches 
                // the password the user submitted.
                if ($db_password == $password) {
                    // Password is correct!
                    // Get the user-agent string of the user.
                    $user_browser = $_SERVER['HTTP_USER_AGENT'];

                    // XSS protection as we might print this value
                    $user_id = preg_replace("/[^0-9]+/", "", $user_id);
                    $_SESSION['user_id'] = $user_id;

                    // XSS protection as we might print this value
                    $username = preg_replace("/[^a-zA-Z0-9_\-]+/", "", $username);

                    $_SESSION['username'] = $username;
                    $_SESSION['login_string'] = hash('sha512', $password . $user_browser);

                    // Login successful. 
                    return true;
                } else {
                    // Password is not correct 
                    // We record this attempt in the database 
                    $now = time();
                    if (!$db->query("INSERT INTO login_attempts(user_id, time) 
                                    VALUES ('$user_id', '$now')")) {
                        header("Location: ../error.php?err=Database error: login_attempts");
                        exit();
                    }

                    return false;
                }
            }
        } else {
            // No user exists. 
            return false;
        }
    } else {
        // Could not create a prepared statement
        header("Location: ../error.php?err=Database error: cannot prepare statement");
        exit();
    }
}

I can see two options here, either...

 

1. change the script above to store each item from the row as it's own session, ie - '$db->prepare("SELECT id, username, password, salt.. // and every other row I want to display from the table...// ") , then bind each to a variable, and assign each to their own session variable. With the view to then echo each when needed, such as $_SESSION['address'];

 

2. after the user is logged in, run a query on the desired page such as "SELECT * FROM myTable WHERE username = $_SESSION['username']" and manage the data that way.

 

Could someone give me some advice as to the more effective/secure method?

Edited January 8, 2014 by paddyfields

[Ch0cu3r]

use Option1, get the users data and store it in the session when they login. When you change the users data in the session, then update the database with the changes too.

[paddy_fields]

Thank you.