I created a very basic site where a user logs in and then has access to a table that they can edit. I want the user to be able to only delete their own details and no one elses, and I don't know what i'm supposed to add to the delete page so it only deletes the details of logged in user and doesn't delete anyone else's. At the moment it doesn't delete any details.
This is my register page
<?php
// Include config file
require_once "pconfig.php";
// Define variables and initialize with empty values
$username = $password = $confirm_password = "";
$username_err = $password_err = $confirm_password_err = "";
// Processing form data when form is submitted
if($_SERVER["REQUEST_METHOD"] == "POST"){
// Validate username
if(empty(trim($_POST["username"]))){
$username_err = "Please enter a username.";
} elseif(!preg_match('/^[a-zA-Z0-9_] $/', trim($_POST["username"]))){
$username_err = "Username can only contain letters, numbers, and underscores.";
} else{
// Prepare a select statement
$sql = "SELECT id FROM users WHERE username = ?";
if($stmt = mysqli_prepare($link, $sql)){
// Bind variables to the prepared statement as parameters
mysqli_stmt_bind_param($stmt, "s", $param_username);
// Set parameters
$param_username = trim($_POST["username"]);
// Attempt to execute the prepared statement
if(mysqli_stmt_execute($stmt)){
/* store result */
mysqli_stmt_store_result($stmt);
if(mysqli_stmt_num_rows($stmt) == 1){
$username_err = "This username is already taken.";
} else{
$username = trim($_POST["username"]);
}
} else{
echo "Oops! Something went wrong. Please try again later.";
}
// Close statement
mysqli_stmt_close($stmt);
}
}
// Validate password
if(empty(trim($_POST["password"]))){
$password_err = "Please enter a password.";
} elseif(strlen(trim($_POST["password"])) < 6){
$password_err = "Password must have atleast 6 characters.";
} else{
$password = trim($_POST["password"]);
}
// Validate confirm password
if(empty(trim($_POST["confirm_password"]))){
$confirm_password_err = "Please confirm password.";
} else{
$confirm_password = trim($_POST["confirm_password"]);
if(empty($password_err) && ($password != $confirm_password)){
$confirm_password_err = "Password did not match.";
}
}
// Check input errors before inserting in database
if(empty($username_err) && empty($password_err) && empty($confirm_password_err)){
// Prepare an insert statement
$sql = "INSERT INTO users (username, password) VALUES (?, ?)";
if($stmt = mysqli_prepare($link, $sql)){
// Bind variables to the prepared statement as parameters
mysqli_stmt_bind_param($stmt, "ss", $param_username, $param_password);
// Set parameters
$param_username = $username;
$param_password = password_hash($password, PASSWORD_DEFAULT); // Creates a password hash
// Attempt to execute the prepared statement
if(mysqli_stmt_execute($stmt)){
// Redirect to login page
header("location: plogin.php");
} else{
echo "Oops! Something went wrong. Please try again later.";
}
// Close statement
mysqli_stmt_close($stmt);
}
}
// Close connection
mysqli_close($link);
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Sign Up</title>
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
<style>
body{ font: 14px sans-serif; }
.wrapper{ width: 360px; padding: 20px; }
</style>
</head>
<body>
<div >
<h2>Sign Up</h2>
<p>Please fill this form to create an account.</p>
<form action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]); ?>" method="post">
<div >
<label>Username</label>
<input type="text" name="username" value="<?php echo $username; ?>">
<span ><?php echo $username_err; ?></span>
</div>
<div >
<label>Password</label>
<input type="password" name="password" value="<?php echo $password; ?>">
<span ><?php echo $password_err; ?></span>
</div>
<div >
<label>Confirm Password</label>
<input type="password" name="confirm_password" value="<?php echo $confirm_password; ?>">
<span ><?php echo $confirm_password_err; ?></span>
</div>
<div >
<input type="submit" value="Submit">
<input type="reset" value="Reset">
</div>
<p>Already have an account? <a href="plogin.php">Login here</a>.</p>
</form>
</div>
And this is my login page
<?php
// Initialize the session
session_start();
// Check if the user is already logged in, if yes then redirect him to welcome page
if(isset($_SESSION["loggedin"]) && $_SESSION["loggedin"] === true){
header("location: allcontacts.php");
exit;
}
// Include config file
require_once "pconfig.php";
// Define variables and initialize with empty values
$username = $password = "";
$username_err = $password_err = $login_err = "";
// Processing form data when form is submitted
if($_SERVER["REQUEST_METHOD"] == "POST"){
// Check if username is empty
if(empty(trim($_POST["username"]))){
$username_err = "Please enter username.";
} else{
$username = trim($_POST["username"]);
}
// Check if password is empty
if(empty(trim($_POST["password"]))){
$password_err = "Please enter your password.";
} else{
$password = trim($_POST["password"]);
}
// Validate credentials
if(empty($username_err) && empty($password_err)){
// Prepare a select statement
$sql = "SELECT id, username, password FROM users WHERE username = ?";
if($stmt = mysqli_prepare($link, $sql)){
// Bind variables to the prepared statement as parameters
mysqli_stmt_bind_param($stmt, "s", $param_username);
// Set parameters
$param_username = $username;
// Attempt to execute the prepared statement
if(mysqli_stmt_execute($stmt)){
// Store result
mysqli_stmt_store_result($stmt);
// Check if username exists, if yes then verify password
if(mysqli_stmt_num_rows($stmt) == 1){
// Bind result variables
mysqli_stmt_bind_result($stmt, $id, $username, $hashed_password);
if(mysqli_stmt_fetch($stmt)){
if(password_verify($password, $hashed_password)){
// Password is correct, so start a new session
session_start();
// Store data in session variables
$_SESSION["loggedin"] = true;
$_SESSION["id"] = $id;
$_SESSION["username"] = $username;
// Redirect user to welcome page
header("location: allcontacts.php");
} else{
// Password is not valid, display a generic error message
$login_err = "Invalid username or password.";
}
}
} else{
// Username doesn't exist, display a generic error message
$login_err = "Invalid username or password.";
}
} else{
echo "Oops! Something went wrong. Please try again later.";
}
// Close statement
mysqli_stmt_close($stmt);
}
}
// Close connection
mysqli_close($link);
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Login</title>
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
<style>
body{ font: 14px sans-serif; }
.wrapper{ width: 360px; padding: 20px; }
</style>
</head>
<body>
<div >
<h2>Login</h2>
<p>Please fill in your credentials to login.</p>
<?php
if(!empty($login_err)){
echo '<div >' . $login_err . '</div>';
}
?>
<form action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]); ?>" method="post">
<div >
<label>Username</label>
<input type="text" name="username" value="<?php echo $username; ?>">
<span ><?php echo $username_err; ?></span>
</div>
<div >
<label>Password</label>
<input type="password" name="password" >
<span ><?php echo $password_err; ?></span>
</div>
<div >
<input type="submit" value="Login">
</div>
<p>Don't have an account? <a href="pregister.php">Sign up now</a>.</p>
</form>
</div>
</body>
</html>
This my contact page
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>Display Contacts</title>
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
<style>
body{ font: 14px sans-serif; }
.wrapper{ width: 360px; padding: 20px; }
</style>
</head>
<body>
<!DOCTYPE html>
<html>
<head>
<title>Display all records from Database</title>
</head>
<body>
<h2>Users</h2>
<table border="2">
<tr>
<td>Sr.No.</td>
<td>Full Name</td>
<td>Password</td>
<td>Edit</td>
<td>Delete</td>
</tr>
<?php
include "pconfig.php"; // Using database connection file here
$records = mysqli_query($link,"select * from users"); // fetch data from database
while($data = mysqli_fetch_array($records))
{
?>
<tr>
<td><?php echo $data['id']; ?></td>
<td><?php echo $data['username']; ?></td>
<td><?php echo $data['password']; ?></td>
<td><a href="edit.php?id=<?php echo $data['id']; ?>">Edit</a></td>
<td><a href="delete.php?id=<?php echo $data['id']; ?>">Delete</a></td>
</tr>
<?php
}
?>
</table>
</body>
</html>
and finally my delete page
<?php
include "pconfig.php"; // Using database connection file here
$id = $_GET['id']; // get id through query string
if($param_username == "$id") {
$del = mysqli_query($link,"delete from users where id = '$id'"); // delete query
mysqli_close($link); // Close connection
header("location:allcontacts.php"); // redirects to all records page
exit;
}
else
{
echo "Error deleting record"; // display error message if not delete
}
?>
CodePudding user response：
<?php
session_start();
include "pconfig.php"; // Using database connection file here
$id = $_GET['id']; // get id through query string
if($_SESSION["id"]!==$id){// display error message if user is not same
echo "You need to delete your own record";
exit;
}
$del = mysqli_query($link,"delete from users where id = '$id'"); // delete query
mysqli_close($link); // Close connection
header("location:allcontacts.php"); // redirects to all records page
exit;
?>
What you need to do is to add session_start() function on the above of the delete page
- use this $_SESSION["id"] session as you have assigned in login page
- always check / compare logic before doing any operation so your code will be remain small, smart, simple ,readable and fast.