0

I got my user.php, header.php and indexph.php. After i log in, i can show my user data but i want to call it in my header, between every page i explore.. my header is another file on my site, i use "require_once('header.php')" to call it on indexph.php or user.php but when i get out of user.php i lost my username data, here is part of my code..

USER.PHP (not all)

<?php include("conexion.php");
require_once("header.php") ?>
<form action="" method="POST" id="loginform">
   <input type="text" placeholder="Usuario" name="usuar">
   <input type="password" placeholder="Contraseña" name="pw">
   <button type="submit" class="btn" name="logi">Login</button>
   <a href="">Olvidaste la contraseña?</a>
</form>
?>

header.php

<?php
include("conexion.php");
if(isset($_POST['logi'])){
   $u=$_POST["usuar"];
   $c=$_POST["pw"];

   $sql="SELECT * FROM usuario
   WHERE usuario='".$u."' AND contr='".$c."' ";

   $res=mysql_query($sql,$con);
   $can=mysql_num_rows($res);
   $b=mysql_fetch_array($res);

   if($can == 1)
   {

    echo "Login OK by ".$u;
    //echo"".$_SESSION['id_user'];
    //header('location:indexph.php');//te envia luego de logear correctamente
    echo "<form action='logout.php' method='POST'>";
    echo "<button type='submit' name='logo'>Logout</button>";
    echo "</form>";
}
else
{
    echo "Login Failed";
}

}

?>

<header id="header">
<div class="navbar">
<nav>
            <ul id="menuitems">
                <li><a href="../index.html">Home</a></li>
                <li><a href="indexph.php">Productos</a></li>
                <li><a href="añadir.html">Añadir</a></li>
                <li><a href="detalle productos.html">D.P&#9760;</a></li>
                <li><a href="account.html">Cuenta</a></li>
            </ul> 
</nav>

            <a href="kart.php" class="nav-item nav-link active">
            <img src="../img/cart.png" width="50px" height="50px">
            </a>
            <!---here i would like to call my username so it shows in every page that calls 
            header.php---->
</div>
</header>

here is my "indexph.php" one of many pages where i want to show my username just calling header.php

<?php
session_start();
require_once('header.php');
if(isset($_SESSION['usuar']))
{
   echo"<br>Logged by ".$_SESSION['usuar'];

}
?>
<html> <!--- here it would be all html, images and everything---> </html>

But i can't, that "echo" is not working, the thing is want the username on header, thats all plz help i cant solve this :c

LeandroDiaz96
  • 23
  • 2
  • 12
  • **Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/5741187) – Dharman Sep 17 '21 at 10:13
  • **Warning:** `mysql_*` extension is deprecated as of PHP 5.5.0, and has been removed as of PHP 7.0.0. Instead, either the [mysqli](https://www.php.net/manual/en/book.mysqli.php) or [PDO_MySQL](https://www.php.net/manual/en/book.pdo.php) extension should be used. See also the [MySQL API Overview](https://www.php.net/manual/en/mysqlinfo.api.choosing.php) for further help while choosing a MySQL API. – Dharman Sep 17 '21 at 10:13
  • Thanks for advising me for the sql injections, i will solve this before uploading my page.. I was using an old version of PHP by the way, thats why im using an oldie code i suppose. – LeandroDiaz96 Sep 17 '21 at 12:33

1 Answers1

0

So in your header.php you need to set the session variable after the login to use it later.

if($can == 1) {
    $_SESSION['id_user'] = $b['id']; // or however your id column is called in the database
    // of course, you can also save the username or whatever value you want in a session variable
}

The thing about sessions and their variables is, that they get saved server-side, so you can use them in concurrent requests and different files until they are destroyed.

But I see several issues with your posted code:

  1. You are using mysql_* functions, which are long deprecated (since PHP 5.5, June 2013). Check, why you shouldn't use them here.
  2. You are wide open to SQL injection attacks. Read up on it here.
  3. You are saving your passwords in clear, human-readable text to your database. If you ever face a database breach, all username / password combinations are open to the world. Maybe some people used these same credentials on other websites. Try to use password_hash and password_verify functions in your code. But first, get comfortable with your current code :)
  4. Not an issue but a (maybe) personal preference. Write your code in English, it will make it easier to get help - like here on SO. People, who don't speak your language will be better able to understand your code. Also, if at some point you decide to hand off the project to a person that is not too keen or even at all able to understand your language, they will struggle for a bit.
stui
  • 353
  • 3
  • 15
  • thanks for your answer! i already set the session variable, but where im on other pages how i call it? may i use.. if(isset($_SESSION['id_user'])) { echo"
    Welcome "; }     – LeandroDiaz96 Sep 17 '21 at 00:10
  • exactly. check if the session variable exists. Don't forget to call `session_start()` beforehand. – stui Sep 17 '21 at 00:13
  • the thing is, in indexph.php i can explore whit an user or not, i dont want to call session_start() everytime im on that page, so thats why i want to show my username on header after loggin in, so in header.php, how can i show it up? i have done that isset but in indexph.php the other page and doesnt work – LeandroDiaz96 Sep 17 '21 at 00:17
  • Why don't you want to call `session_start()`? You need it for this to work. – stui Sep 17 '21 at 08:12
  • I want to call session_start() but just after the user log in, and i want to call it just in header.php and show the username and when i log out i want to hide this or destroy it – LeandroDiaz96 Sep 17 '21 at 12:35