0

I have an admin area in an ecommerce website whereby the admin can view all users on the allusers.php page. The users are listed in a table with their personal information, however i have a 'view profile' button near each user whereby if you was to click on it, it would take you to another page where you can view that specific users past orders.

the following is the code i have for allusers.php:

    <?php

$result = mysql_query("SELECT * FROM customers ")
or die(mysql_error()); ;

if (mysql_num_rows($result) == 0) {
       echo 'There Arent Any Orders Yet';
    } else {

echo "<table border='0'><table border width=100%><tr><th>First Name</th><th>Surname</th><th>Address</th><th>E-Mail</th><th>Username</th><th>View Profile</th>";
while($info = mysql_fetch_array($result))
{
        echo "<tr>";
        echo "<td>" . $info['name']. "</td>";
        echo "<td>" . $info['surname']. "</td>";
        echo "<td>" . $info['address1']. $info['address2'].  $info['city'].  $info['postcode']." </td>";
        echo "<td>" . $info['email']. "</td>";
        echo "<td>" . $info['username']. "</td>";
        echo "<td>" . " <a href='view.php'>View</a> </td>";


}
    }
echo "</tr>";
echo "</table>";
?>

the view.php page is as follows:

<?php


$result = mysql_query("SELECT * FROM order WHERE ......dont know what to enter here")
or die(mysql_error()); ;

if (mysql_num_rows($result) == 0) {
       echo 'There Arent Any Orders For This Customer Yet';
    } else {

echo "<table border='0'><table border width=100%><tr><th>Product</th><th>Quantities</th><th>Date</th>";
while($info = mysql_fetch_array($result))
{
        echo "<tr>";
        echo "<td>" . $info['name']. "</td>";
        echo "<td>" . $info['quantity']. "</td>";
        echo "<td>" . $info['date']. " </td>";
}
    }
echo "</tr>";
echo "</table>";
?>

I have a mysql database with the following fields & tables:

Customers - id, name, surname, address1, address2, city, postcode, email, username, password

Products - serial, name, description, price, picture

Order - id, name, quanitity, price, date, username

Thanks for any help provided

0

3 Answers 3

2

Your code lacks any sort of security mechanisms... This is very bad, especially in an e-commerce setting.

Excusing that, you would pass the username to the view page in the URL.

echo "<td>" . " <a href='view.php?user=" . $info['username'] . "'>View</a> </td>";

In your view page, you would get the parameter from the URL and include it with your query.

if (isset($_GET) && isset($_GET['user'])) {
   $user = mysql_real_escape_string($_GET['user']);
} else {
   header('Location: allusers.php');
   exit(); // boot them back to the previous page.
}
$result = mysql_query("SELECT * FROM order WHERE username = '" . $user . "'")
1
  • 1
    This solution will work if you replace $info['id'] with $info['username'] Nov 22, 2011 at 23:27
1

A simple method could be the follow. Replace this line in alluser.php

echo "<td>" . " <a href='view.php'>View</a></td>";

with this one

echo '<td><a href="view.php?username=' . $info['username'] . '">View</a></td>';

and then, in your view.php have

if (isset($_GET['username']) && $_GET['username'] != '')
{
   $username = mysql_real_escape_string($_GET['username']);
   $result = mysql_query("SELECT * FROM order WHERE username = '$username'");
}
else
{
  // No user specified. Do other statements
}

Please note the use of:

  1. The user of the mysql_real_escape_string() function to protect from Sql injection (would be better the use of a prepared statements)
  2. The use of the parameter username in the first page to pass the value of the username to the second page
  3. The use of the $_GET global array to retrieve the parameter
1

Try this:

allusers.php

<?php

$result = mysql_query("SELECT * FROM customers ")
or die(mysql_error()); ;

if (mysql_num_rows($result) == 0) {
       echo 'There Arent Any Orders Yet';
    } else {

echo "<table border='0'><table border width=100%><tr><th>First Name</th><th>Surname</th><th>Address</th><th>E-Mail</th><th>Username</th><th>View Profile</th>";
while($info = mysql_fetch_array($result))
{
        echo "<tr>";
        echo "<td>" . $info['name']. "</td>";
        echo "<td>" . $info['surname']. "</td>";
        echo "<td>" . $info['address1']. $info['address2'].  $info['city'].  $info['postcode']." </td>";
        echo "<td>" . $info['email']. "</td>";
        echo "<td>" . $info['username']. "</td>";
        echo "<td>" . " <a href='view.php?user={$info['username']}'>View</a> </td>";


}
    }
echo "</tr>";
echo "</table>";
?>

view.php

<?php

$user = mysql_real_escape_string($_GET['user']);
$result = mysql_query("SELECT * FROM order WHERE user = '$user'")
or die(mysql_error()); ;

if (mysql_num_rows($result) == 0) {
       echo 'There Arent Any Orders For This Customer Yet';
    } else {

echo "<table border='0'><table border width=100%><tr><th>Product</th><th>Quantities</th><th>Date</th>";
while($info = mysql_fetch_array($result))
{
        echo "<tr>";
        echo "<td>" . $info['name']. "</td>";
        echo "<td>" . $info['quantity']. "</td>";
        echo "<td>" . $info['date']. " </td>";
}
    }
echo "</tr>";
echo "</table>";
?>
3
  • oh guys, btw i have 1 more question. as you can see on the allusers.php page, i have a table and within the table i have a row where it contains address1, address2, city and postcode. this appears all on one line, how do i format it so it appears one under each other without putting it into another column/row?
    – Jahed
    Nov 22, 2011 at 23:46
  • the code im talking about is this: echo "<td>" . $info['address1']. $info['address2']. $info['city']. $info['postcode']." </td>";
    – Jahed
    Nov 22, 2011 at 23:47
  • 1
    <td>" . $info['address1'].'<br>'. $info['address2'].'<br>'. $info['city'].'<br>'. $info['postcode']." </td> Nov 22, 2011 at 23:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.