Member based site returns same user regardless of profile clicked

Question

I've been trying to figure this out on and off for a while, but I have a member based site that returns the same user regardless of the profile chosen and I'm not sure what's going on.

Here is my header

<?php

//START SESSION
ob_start();
session_start();

include_once 'functions.php';

if(isset($_SESSION['email']))
{
    $email      = $_SESSION['email'];
    $loggedin  = TRUE;
    $userstr   = " $email";
} else {
    $loggedin = FALSE;
}

if($loggedin) {
    include_once "navIn.php";
} else {
    include_once "navOut.php";
}

This is my function that actually returns the user profile.

function showProfile($email)
{
    if(file_exists("users/$row[0]/$row[0]pi.jpg"))
        echo "<img src='/users/$row[0]/$row[0]pi.jpg'>";
    else
        echo "<i id='user-img-dflt' class='fa fa-user' aria-hidden='true'></i><br>";

    $result = queryMysql("SELECT * FROM profiles");

    if(mysql_num_rows($result))
    {   
        $row = mysql_fetch_row($result);
        echo "Contact: $row[3]"; 
        echo "<h4>Statement</h4>";
        echo "<p>";
        echo stripcslashes($row[2]) . "<br clear='left' /><br/>";
        echo "</p>";
        echo "<h4>Work</h4>";
        echo "<div class='gallery row'>";

        //image1
        if(file_exists("users/$row[0]/work/$row[0]w1.jpg"))
            echo "<div class='col-md-2'>".
                 "<a href='/users/$row[0]/work/$row[0]w1.jpg'>" .
                 "<img class='thumbnail' src='/users/$row[0]/work/$row[0]w1.jpg'>" .
                 "</a>" .
                 "</div>";
            else 
                echo "<div class='col-md-2'></div>";

        //image2
        if(file_exists("users/$row[0]/work/$row[0]w2.jpg")) {
            echo "<div class='col-md-2'>".
                 "<a href='/users/$row[0]/work/$row[0]w2.jpg'>" .
                 "<img class='thumbnail' src='/users/$row[0]/work/$row[0]w2.jpg'>" .
                 "</a>" .
                 "</div>";
        } else {
            echo "<div class='col-md-2'></div>";
        }

        //image3
        if(file_exists("users/$row[0]/work/$row[0]w3.jpg")) {
            echo "<div class='col-md-2'>".
                 "<a href='/users/$row[0]/work/$row[0]w3.jpg'>" .
                 "<img class='thumbnail' src='/users/$row[0]/work/$row[0]w3.jpg'>" .
                 "</a>" .
                 "</div>";
        } else {
            echo "<div class='col-md-2'></div>";
        }

        //image4
        if(file_exists("users/$row[0]/work/$row[0]w4.jpg")) {
            echo "<div class='col-md-2'>".
                 "<a href='/users/$row[0]/work/$row[0]w4.jpg'>" .
                 "<img class='thumbnail' src='/users/$row[0]/work/$row[0]w4.jpg'>" .
                 "</a>" .
                 "</div>";
        } else {
            echo "<div class='col-md-2'></div>";
        }

        //image5
        if(file_exists("users/$row[0]/work/$row[0]w5.jpg")) {
            echo "<div class='col-md-2'>".
                 "<a href='/users/$row[0]/work/$row[0]w5.jpg'>" .
                 "<img class='thumbnail' src='/users/$row[0]/work/$row[0]w5.jpg'>" .
                 "</a>" .
                 "</div>";
        } else {
            echo "<div class='col-md-2'></div>";
        }

        //image6
        if(file_exists("users/$row[0]/work/$row[0]w6.jpg")) {
            echo "<div class='col-md-2'>".
                 "<a href='/users/$row[0]/work/$row[0]w6.jpg'>" .
                 "<img class='thumbnail' src='/users/$row[0]/work/$row[0]w6.jpg'>" .
                 "</a>" .
                 "</div>";
        } else {
            echo "<div class='col-md-2'></div>";
        }

        echo "</div>";
    }
}

Lastly here is my members page that displays members and allows you to click on the profile.

<?php 
//members.php

include_once 'head.php';

echo "<div id='content' class='container'>";

if(isset($_GET['view']))
{
    $view = sanitizeString($_GET['view']);

    $result = queryMysql("SELECT * FROM members");
    $row = mysql_fetch_row($result);

    echo "<h3>$row[2] $row[3]</h3>";
    showProfile($view);
    echo "</div>";
    include_once 'footer.php';
    die();

}


$stuff = queryMysql("SELECT * FROM members");
$num    = mysql_num_rows($stuff);

echo "<h3>Members</h3>";
echo "<div class='row'>";

for ($j = 0; $j < $num; ++$j)
{
    $row = mysql_fetch_row($stuff);
    if($row[1] == $email) continue;

    if(file_exists("users/$row[0]/$row[0]pi.jpg")) {
        echo "<div class='col-md-4'><a href='?view=$row[0]'><img src='/users/$row[0]/$row[0]pi.jpg'/> <br>$row[2] $row[3]   </a></div>";
    }
    else {
        echo "<div class='col-md-4'><a href='?view=$row[0]'><i id='user-img-dflt' class='fa fa-user' aria-hidden='true'></i> <br>$row[2] $row[3]    </a></div>";
    }
}

echo "</div>";
echo "</div>";
?>

<?php include_once 'footer.php'; ?>

My MySQL database is pretty simple it has two tables:

members[id, email, firstName, lastName, pass] profiles[id, statement, contact, website]

When I click on another profile the view id is correct but the profile remains regardless.

Use a `where` clause. You are only selecting the first row everytime. I'm also not sure what `sanitizeString` does but I'd suggest updating to mysqli or pdo and using parameterized queries. — chris85, Apr 15 '17 at 16:06
As mysql_* was deprecated in PHP 5.5 (please refer to [PHP doc](http://php.net/manual/en/function.mysql-connect.php)) you should **really** consider using [PPS : Prepared Parameterized Statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). This will help [Preventing SQL injection](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — OldPadawan, Apr 15 '17 at 16:07
as stated by @chris85 you should also add a `where memberID=$your_var_ID` in `showProfile` — OldPadawan, Apr 15 '17 at 16:09
Thanks, I will definitely looking using PPS in the future I was modifying code examples from an O'Reilly book, so thats the reason I'm using any deprecated code. — Xavier, Apr 15 '17 at 16:17

score 0 · Answer 1 · answered Apr 21 '17 at 02:52

0

Figured it out thanks to the comments posted. In my showProfile function:

   $result = queryMysql("SELECT * FROM profiles WHERE id='$id'");

And in my members page:

  $result = queryMysql("SELECT * FROM members WHERE id = '$view'");

answered Apr 21 '17 at 02:52

Xavier

119
1
13

Member based site returns same user regardless of profile clicked

1 Answers1