I want to update my MySQL table using a php script based off the currently logged in username

Question

I have a MySQL database that currently has a table called "loginInfo" which stores the users email, phone number, username, and password. Once they log in, I want to have an option for them to update their email and/or their phone number (the password is handled separately but I would assume would work similarly to this.) I know I would have to use the "UPDATE loginInfo SET email = newemail@test.com WHERE username = logged_in_username"; My issue is, I don't know how to fetch the current logged in users username is. I have a login.php script that looks through the table for a matching username and password, as well as a createAccount.php script that adds an email/username/password to the table as well.

I believe I would know how to do this as long as I knew how to fetch what the current logged in username is, just unfamiliar with how I could go about doing so.

login.php

<?php
    session_start();
    include_once 'conn.php';

    if(empty($_POST['username']) || empty($_POST['password']))
            header('Location: ../html/index.html');
    else {
        if(isset($_POST['loginBtn'])) {
            $username = $_POST['username'];
            $password = $_POST['password'];
            $password = md5($password);

            $_SESSION['username'] = $username;
            $_SESSION['password'] = $password;

            $query = "SELECT username, password FROM loginInfo WHERE username=? AND password=? LIMIT 1";

            $stmt = $conn->prepare($query);
            $stmt -> bind_param("ss", $username, $password);
            $stmt -> execute();
            $stmt -> bind_result($username, $password);
            $stmt -> store_result();
            if($stmt->fetch()) {
                header('Location: ../html/mainPage.html');
            }
            else {
                echo "Error logging in";
            }
            mysqli_close($conn);
        }
    }
?>

updateInfo.html

<html>
    <link rel="stylesheet" href="../css/updateInfo.css">
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css">

    <script src="https://code.jquery.com/jquery-3.3.1.js"></script>
<body>

    <div class="header">
        <h1 id="head1">Lost And Found</h1>

        <div class="navbar">
        <a href="mainPage.html" class="home-btn">Home</a>

            <div class="profile-dropdown">
            <button class="profile-btn">Profile <i class="fa fa-caret-down"></i></button>
            <div class="profile-content">
                <a href="yourListings.html">Your Listings</a>
                <a href="updateInfo.html">Update Info</a>
            </div>
        </div>

        <div class="search-dropdown">
            <button class="search-btn">Search <i class="fa fa-caret-down"></i></button>
            <div class="search-content">
                <a href="searchLost.html">Search Lost</a>
                <a href="searchFound.html">Search Found</a>
            </div>
        </div>

         <div class="listings-dropdown">
            <button class="listings-btn">Listings <i class="fa fa-caret-down"></i></button>
            <div class="listings-content">
                <a href="reportLost.html">Report Lost</a>
                <a href="reportFound.html">Report Found</a>
            </div>
        </div>

           <div class="settings-dropdown">
            <button class="settings-btn">Settings <i class="fa fa-caret-down"></i></button>
            <div class="settings-content">
                <a href="changePassword.html">Change Password</a>
            </div>
        </div>
        <a href="index.html" class="logout-btn">Logout</a>
        </div>
    </div>


    <script type="text/javascript">
        var nav = document.getElementsByClassName("navbar");

        window.onscroll = function sticky() {
            if(window.pageYOffset > nav[0].offsetTop) {
                nav[0].classList.add("nav");
            }
            else {
                nav[0].classList.remove("nav");
            }
        }
    </script>
    <form class="login-box" action="../php/updateInfo.php" method="post">
            <h1 id="header3">Update Account Info</h1>
            <input type="text" name="newEmail" placeholder="New Email">
            <input type="text" name="newPhone" placeholder="New/Add Phone Number">
            <input type="submit" name="updateBtn" value="Update">
            <a href="createAccount.html">Want to change your password?</a>
        </form>

   <div class="footer">
            <a class="social-btn" href="http://www.facebook.com"><i class="fa fa-facebook"></i></a>
            <a class="social-btn" href="http://www.twitter.com"><i class="fa fa-twitter"></i></a>
            <a class="social-btn" href="http://www.youtube.com"><i class="fa fa-youtube"></i></a>
            <a class="social-btn" href="http://www.instagram.com"><i class="fa fa-instagram"></i></a>
        </div>
</body>
</html>

Expected results should let the currently logged in user update their email/phone number within the loginInfo table, replacing their old information.

You store your Username in SESSION, see if you can pull that var from there. IF yes , just get the user name from session and add it to your update statement in where clause. But it is better to store id then username. — Serghei Leonenco, Jul 16 '19 at 01:22
what's you question? you mean how do you update? yes just start by getting the user input, and making an update statement using the user id — Kevin, Jul 16 '19 at 01:22
by the way, ditch that `md5` hashing and use better tool, `password_hash` + `password_verify` — Kevin, Jul 16 '19 at 01:23
@Ghost i agree, it is alway better to use some tools and better practices while developing your own app, especially when you start. — Serghei Leonenco, Jul 16 '19 at 01:25
Instead of storing usernames or passwords in sessions, you might consider a [token-based authentication](https://stackoverflow.com/questions/1592534/what-is-token-based-authentication?rq=1) system. — showdev, Jul 16 '19 at 01:27
You might find this informative: [The definitive guide to form-based website authentication](https://stackoverflow.com/questions/549/the-definitive-guide-to-form-based-website-authentication). — showdev, Jul 16 '19 at 01:35

score 0 · Answer 1 · answered Jul 16 '19 at 01:33

So you need to know how to get the logged in username in other places, If I have read your text right.

This is how you could do that.

Save the username in the session after a successfull login.

if($stmt->fetch()) { $_SESSION['username'] = $username; header('Location: ../html/mainPage.html'); }
Then in any other place, you can read the logged in username with $_SESSION['username'].

Please note, on pages you use $_SESSION, you have to add session_start(); at the very first line as you have done in login.php file.

And, please remember to unset $_SESSION['username'] when the user sign-out.

I want to update my MySQL table using a php script based off the currently logged in username

1 Answers1