how to make a profile editor

[rallokkcaz]

i have the basic concept of it

its just that i wanna make it so only the user themselves can edit not other people

and ive tried this before and it hasn't worked

 

does any one have any ideas???

 

Thanks

[shaunrigby]

Lookup "php sessions" (minus quotes) on Google to find out how to add variables to a session, and use it to determine if the person logged in is allowed to edit it using a boolean true/false

[rallokkcaz]

ok

 

 

[Mr. R]

use something like..

 

<?php
session_start();

if(!isset($_SESSION['username'])) {

echo "You must be logged in to view this page!"
exit();

}else{

//make a query to retrieve thier information from the database WHERE $_SESSION['username'] = 'username'

}
?>

[rallokkcaz]

ok here is the code i have on the edit page

<?php

require '../config.php';

session_start();

if(!isset($_SESSION['id'])) {

echo "You must be logged in to view this page!";
exit();

}else{

//make a query to retrieve thier information from the database WHERE $_SESSION['username'] = 'username'


    $id = $_GET['id'];

    $sql = "SELECT * FROM users WHERE id='$id'";

    $result = @mysql_query($sql) or die(mysql_error());

    $user = mysql_fetch_assoc($result);
    echo <<<HTMLFORM
<form action="{$_SERVER['PHP_SELF']}" method="post">
<table  cellpadding="2" cellspacing="1" width="400">
  <tr>
    <td wdith="35%">Username:</td>
    <td>{$user['username']}</td>
  </tr>  
  <tr>
    <td>Full Name:</td>
    <td><input type="text" name="fullname" value="{$user['']}" /></td>
  </tr><tr>
    <td>Password</td>
    <td>
New Password: <input type="password" name="password" value="$password" /></td>
  </tr>
<tr>
    <td>About Me:</td>
    <td><textarea height="200px" width="300px" input type="text/html"  name="about" value="" />{$user['aboutme']}</textarea></td>
  </tr><tr
  <tr>
    <td>Email Address:</td>
    <td><input type="text" name="email" value="{$user['email']}" /></td>
  </tr>
  <tr>
    <td colspan="2">
      <input type="hidden" name="id" value="{$user['id']}" />
      <input type="submit" name="update" value="Update Profile" onsubmit="$sql">
    </td>
  </tr>
</table>
</form>
HTMLFORM;
}
    foreach($_POST as $field_name => $field_value)
    {
        ${$field_name} = mysql_real_escape_string($field_value);
    }

    $sql = "UPDATE users  set password='$password', about='$aboutme', email='$email', fullname='$fullname' WHERE id='$id'";

    $result = mysql_query($sql) or die(mysql_error());

    echo "Successfully updated profile <br>
<a href='profiles.php?id=$id'>Go to Profile</a>";



?>

 

can anyone help me fix it??

thanks

[rallokkcaz]

anyone????????????  ;D ;D

[AndyB]

can anyone help me fix it??

 

Well, what does it do that it shouldn't? What doesn't it do that it should? Start by removing the @ error suppression - maybe that'll help.