<?php
// Inialize session
session_start();
// Check, if username session is NOT set then this page will jump to login page
if (!isset($_SESSION['username'])) {
header('Location: index.php');
}
$online = rand(12,200);
if($_GET['pass'] == "changethis"){
?>
<font color="00c000">
<html>
<head>
<title>Premium Girls ~ Logged in</title>
</head>
<body>
<p align="right">Online Users:<?php echo "$online"; ?></p><br>
<body bgcolor="#004000">
<center><img src="/logo.gif"></img>
<p>Welcome to the Admin Panel, <?php echo $_SESSION['username']; ?>.
<br>
<form method="post" action="newuser.php"><br>
<center>Create a new user:<br></center>
Username:<input type="text" name="username"><br>
Password:<input type="password" name="password"><br>
<input type=submit value="Create new user">
</form>
<br><br>
<div id=footer align=center>Please note we are currently under setup.</div>
</body>
</html></font>
<?php
}else{
?>
<font color="00c000">
<html>
<head>
<title>Premium Girls ~ Payment Processor</title>
</head>
<body>
<p align="right">Online Users:<?php echo "$online"; ?></p><br>
<body bgcolor="#004000">
<center><img src="/logo.gif"></img>
<p>Welcome to the Logged in screen, <?php echo $_SESSION['username']; ?>. Below you will see all the payments linked to your model name.</p>
<?php
$con = mysql_connect("localhost","devacc_yourmum","changeme123");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db("devacc_models", $con);
$uid = $_SESSION['username'];
$result = mysql_query("SELECT * FROM payments WHERE model = {$_SESSION['username']}");
echo "<table border='1'>
<tr>
<th>Name</th>
<th>Payment ID</th>
<th>Address</th>
<th>Nickname</th>
<th>Email</th>
<th>Skype</th>
<th>CardType</th>
<th>Model Name</th>
<th>Country</th>
</tr>";
while($row = mysql_fetch_array($result))
{
echo "<tr>";
echo "<td>" . $row['Name'] . "</td>";
echo "<td>" . $row['Payment ID'] . "</td>";
echo "<td>" . $row['Address'] . "</td>";
echo "<td>" . $row['Nickname'] . "</td>";
echo "<td>" . $row['Email'] . "</td>";
echo "<td>" . $row['Skype'] . "</td>";
echo "<td>" . $row['cardtype'] . "</td>";
echo "<td>" . $row['model'] . "</td>";
echo "<td>" . $row['country'] . "</td>";
echo "</tr>";
}
echo "</table>";
mysql_close($con);
?>
<br><br><br><br><br><br>
<div id=footer align=center>Please note we are currently under setup.</div>
</body>
</html></font>
<?php
}
?>
Above is my code which unfortunately gives me an error. It is supposed to pull all information from the payments table in the database with the models username so if I'm logged in with the username "Bradandrews4" and someone purchased a show from me, it would be the SELECT * FROM payments WHERE model = bradandrews4
it would be bradandrews4 because that's the username I'm logged in with. To output my username I could do either $uid or $_SESSION['username'] however I'm not sure how to get that into the query and then put it through the table. Any help would be much appreciated :)
-Brad
"SELECT * FROM payments WHERE model = \'{$_SESSION['username']}\'"
Milan Halada 2012-04-04 07:35
O'Reilly
? Why are people so scared of PDO - DCoder 2012-04-04 07:36
O'Reilly
, but for SQL injection prevention too - Milan Halada 2012-04-04 07:39
Replace your query with this:
mysql_query("SELECT * FROM payments WHERE model = '" . mysql_real_escape_string($_SESSION['username']) . "'");
just place the ''
around your input..?
SELECT * FROM payments WHERE model = '{$_SESSION['username']}'
would be easier to assign the value to another variable
$un = mysql_real_escape_string($_SESSION['username']);
SELECT * FROM payments WHERE model = '$un'
just write
$result = mysql_query("SELECT * FROM payments WHERE model ='".$uid."'");
Use quotes around your values like in the answer from snaderss.
Alo there is security vulnerability in your session validate.
if (!isset($_SESSION['username'])) {
header('Location: index.php');
}
if someones browser ignores the location header, the user will see your premium content. same if someone access your site via curl() or something similar.
Always use exit(); or die(); after you redirect.
fixed code:
if (!isset($_SESSION['username'])) {
header('Location: index.php');
exit();
}
now the script stops when the redirect fails
$sql = "SELECT * FROM cards WHERE model = '".$uid."' ";
$result = mysql_query($sql);
Thanks everyone, above I posted the 2 lines I have changed in order to get it working... I'm sure all of you're posts would have fixed the problem too but I ended up fixing it myself... :)
-Brad
You could just use this query as it is easier to remember.
mysql_query("SELECT * FROM payments WHERE model = '{$_SESSION['user']}'");