Echo MySQL Row Data

Question

gpdrums 0 Light Poster

18 Years Ago

Hi All:

I have an extensive website in which I would like to echo the name of the company various pages after the user logs in. I think I should be using the $_SESSION global, but I'm having difficulty implementing it, placing it in my code, and knowing what php code to place in the pages where I want the company name to appear. From what I understand, I need to fetch the company name and assign it to the session while the user name and password are being authenticated.

For purposes of this question, the MySQL table is laid out as follows:

[LIST]
[*]id
[*]username
[*]password
[*]usergroup (not being used yet)
[*]company
[*]last_login
[/LIST]

Here's my check-login code:

<?php

  $host = "---";
  $username = "---";
  $password = "---";
  $db = "---";
  $tbl_name = "---";

// Connect to server and select database.
mysql_connect($host, $username, $password) or die("Unable to connect to database.");
mysql_select_db($db) or die("Unable to connect to database.");


// Username and password sent from form.
$myusername = mysql_real_escape_string($_POST['myusername']);
$mypassword = mysql_real_escape_string($_POST['mypassword']);


$sql = "SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result = mysql_query($sql);

// Mysql_num_row is counting table row
$count = mysql_num_rows($result);

// If result matched $myusername and $mypassword, table row must be 1 row
  if($count==1) {

// Register $myusername, $mypassword and redirect to file "login_success.php"
  session_register("myusername");
  session_register("mypassword");

// Update the last_login field of the MySQL database
$lastlogin = mysql_query("UPDATE $tbl_name SET last_login=now() WHERE username='$myusername'");

// Redirect good login attempt
  header("location:login_success.php");
  }

// Redirect bad login attempt
  else {
    header("location:login_retry.php");
    }
?>

mysql php session

3 Contributors
10 Replies
216 Views
5 Days Discussion Span
Latest Post 18 Years Ago Latest Post by MVied

Dani AI

Generated 7 Months Ago

Quick summary and context (ties to the thread)
was right to suggest storing the company name in a session variable; was also right to warn about using the old session_register() style (it was deprecated/removed). The “Welcome,”-without-name symptom in Post #7 is a simple logic bug (a stray semicolon/incorrect use of session_register made the check always pass) rather than a session-storage mystery. (man.hubwiz.com)

Recommended modern approach (what to do at login)

Authenticate with a modern password scheme (store hashes with password_hash(), verify with passwordverify()) and use prepared statements (PDO or MySQLi) instead of the old mysql* functions (ext/mysql was deprecated and removed). Do not store the password in the session. After successful auth call session_start(), regenerate the session id, then set only the minimal session values (user id and either company_id or company name). (php.net)

Safe, minimal example for pages that show the company
(put this at the very top of any page that needs session data)

<?php
session_start();
if (!empty($_SESSION['company'])) {
    echo 'Welcome, ' . htmlspecialchars($_SESSION['company'], ENT_QUOTES, 'UTF-8');
}
?>

Notes, caveats and quick fixes

Always call session_start() before any output. (php.net)
Escape any session-derived text before output (htmlspecialchars / follow OWASP XSS rules). (php.net)
Prefer storing an identifier (company_id) and re-querying when the company name can change, or refresh the session value after an update.
Use HTTPS, set Secure and HttpOnly cookie flags, and regenerate the session id after login to reduce fixation/hijack risk. (cheatsheetseries.owasp.org)

This fills the gaps in the earlier replies: don’t use sessionregister or mysql* in new code, always call session_start(), escape output, and avoid storing secrets in the session.

All 10 Replies

MVied 11 Junior Poster

18 Years Ago

If you'd like to do it in a session variable, do this.

<?php

  $host = "---";
  $username = "---";
  $password = "---";
  $db = "---";
  $tbl_name = "---";

// Connect to server and select database.
mysql_connect($host, $username, $password) or die("Unable to connect to database.");
mysql_select_db($db) or die("Unable to connect to database.");

// If no magic quotes, add slashes
if(!get_magic_quotes_gpc()) {
$myusername = addslashes($_POST['myusername']);
$mypassword = addslashes($_POST['mypassword']);
}

// Username and password sent from form.
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);


$sql = "SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result = mysql_query($sql);
$row = mysql_fetch_assoc($result);

// Mysql_num_row is counting table row
$count = mysql_num_rows($result);

// If result matched $myusername and $mypassword, table row must be 1 row
  if($count==1) {

// Register $myusername, $mypassword and redirect to file "login_success.php"
  session_register("myusername");
  session_register("mypassword");
  session_register("mycompany");
  
// Assign the mycompany variable from user table
  $_SESSION['mycompany'] = $row['company'];

// Update the last_login field of the MySQL database
$lastlogin = mysql_query("UPDATE $tbl_name SET last_login=now() WHERE username='$myusername'");

// Redirect good login attempt
  header("location:login_success.php");
  }

// Redirect bad login attempt
  else {
    header("location:login_retry.php");
    }
?>

I'm not completely certain you need to register the username and password with the session, but I may be wrong. It's be a while since I wrote my own session handler.

Oh, and if magic_quotes_gpc is enabled, you should use stripslashes() on the submitted form data and visa versa.

gpdrums commented: Great work, appreciate the help! +1

R0bb0b 344 Posting Shark

18 Years Ago

Also, you shouldn't be using session_register() as this is registering a global variable. You will find that in most hosts, register globals is turned off and in php 6.0 it is completely removed. You shouldn't be using register globals anyway. You only need to use $_SESSION[].

So, unless you really feel like revisiting everything you've done with sessions, I recommend not doing this.

MVied 11 Junior Poster

18 Years Ago

Also, you shouldn't be using session_register() as this is registering a global variable. You will find that in most hosts, register globals is turned off and in php 6.0 it is completely removed. You shouldn't be using register globals anyway. You only need to use $_SESSION[].
So, unless you really feel like revisiting everything you've done with sessions, I recommend not doing this.

Ah see, news to me R0b. I haven't messed with session in forever. So maybe this is what he should use.

<?php

  $host = "---";
  $username = "---";
  $password = "---";
  $db = "---";
  $tbl_name = "---";

// Connect to server and select database.
mysql_connect($host, $username, $password) or die("Unable to connect to database.");
mysql_select_db($db) or die("Unable to connect to database.");

// If no magic quotes, add slashes
if(!get_magic_quotes_gpc()) {
$myusername = addslashes($_POST['myusername']);
$mypassword = addslashes($_POST['mypassword']);
}

// Username and password sent from form.
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);


$sql = "SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result = mysql_query($sql);
$row = mysql_fetch_assoc($result);

// Mysql_num_row is counting table row
$count = mysql_num_rows($result);

// If result matched $myusername and $mypassword, table row must be 1 row
  if($count==1) {

// Assign session variables from user table
 $_SESSION['mycompany'] = $row['company'];
 $_SESSION['myusername'] = $row['username'];

// Update the last_login field of the MySQL database
$lastlogin = mysql_query("UPDATE $tbl_name SET last_login=now() WHERE username='$myusername'");

// Redirect good login attempt
  header("location:login_success.php");
  }

// Redirect bad login attempt
  else {
    header("location:login_retry.php");
    }
?>

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

R0bb0b 344 Posting Shark · Answer 1 · 2008-08-14T05:40:13+00:00

Not a problem, I've just heard horror stories about php 4.2 when developers had to go back through the scripts that they wrote in the past because register globals was turned off. The less of that we have in the future the better off we'll be.

Yes, that would be the best way to go.

gpdrums 0 Light Poster · Answer 2 · 2008-08-14T06:37:40+00:00

Thank you for the replies. I will have to continue this Friday or next Monday due to other web obligations.

With regard to the php version, we are self-hosting. I can reconfigure Apache if need be, but what I'm doing works--and if it aint broke, don't fix it! Right?

One more thing: I have to try out the code you both provided to see how it goes, but if I want to echo the company name on any page while the session is active, what do I need to do?

Thank you again for helping me here. I'll return the favor as often as I can.

GP

gpdrums 0 Light Poster · Answer 3 · 2008-08-15T05:56:29+00:00

Update: This worked. Thank you for the help. FYI, here's what I did to echo the company name on the appropriate pages:

<?php
if (!session_register(company));
{
echo $_SESSION['company'];
}
?>

MVied 11 Junior Poster · Answer 4 · 2008-08-15T09:51:26+00:00

Update: This worked. Thank you for the help. FYI, here's what I did to echo the company name on the appropriate pages:
<?php
if (!session_register(company));
{
echo $_SESSION['company'];
}
?>

Well if you shouldn't use session_register, maybe you should use this:

if ($_SESSION['company']) {
 echo $_SESSION['company'];
}

R0bb0b 344 Posting Shark · Answer 5 · 2008-08-15T09:59:35+00:00

Well if you shouldn't use session_register, maybe you should use this:
if ($_SESSION['company']) {
 echo $_SESSION['company'];
}

I usually go a step further and do this:

if (isset($_SESSION['company']) && trim($_SESSION['company']) != "") {
 echo $_SESSION['company'];
}

which will also ensure that it is not blank

gpdrums 0 Light Poster · Answer 6 · 2008-08-15T10:14:24+00:00

As I continued to play with the code, I added "Welcome, " to the echo() statement. I noticed that if the person was not logged in, "Welcome," printed without the company name. What type of else statement will keep this from happening?

MVied 11 Junior Poster · Answer 7 · 2008-08-18T20:35:36+00:00

As I continued to play with the code, I added "Welcome, " to the echo() statement. I noticed that if the person was not logged in, "Welcome," printed without the company name. What type of else statement will keep this from happening?

So you have this?

if (isset($_SESSION['company']) && trim($_SESSION['company']) != "") {
 echo "Welcome, ".$_SESSION['company'];
}

Echo MySQL Row Data

Dani AI

Recommended Answers Collapse Answers

All 10 Replies

Recommended Answers