-2

As with my previous posts, I am creating an online storefront. What I am trying to do this time (which is the final part I need to complete) is to allow the Admin OR the user who posted the item to be able to edit/delete the item. This is the code that I created to check if the 'seller id' of that specific item is the same as $_SESSION['user_id']. If it is, enable that user (if he/she is not the admin) to edit/delete that item. But the problem is, only the Admin is able to edit/delete the item even with that code. Anyone know why?

<?php
      $mysqli = mysqli_connect("localhost", "php24sql", "some password", "smithside");
      $query2 = "SELECT * FROM lots";
      $results2 = mysqli_query ($mysqli, $query2);
      $row2 = mysqli_fetch_assoc($results2); 
      $seller = $row2['seller'];
      }
      ?>
      <?php if ($accessLevel == 'Admin' || $seller == $_SESSION['user_id']) { ?>
      <a class="button edit" 
        href="index.php?content=lotdelete&cat_id=<?php echo $cat_id_in; ?>&lot_id=<?php echo $lot->getLot_id(); ?>">Delete
      </a>
      <a class="button edit" 
        href="index.php?content=lotedit&cat_id=<?php echo $cat_id_in; ?>&lot_id=<?php echo $lot->getLot_id(); ?>">Edit
      </a>
<?php } ?>

Please help if you can! Thanks!

11
  • 1
    @DagurTidalwave Please change the database credentials. They might not matter to you (they could be temporary credentials to a private development server), but it is good practice to always remove private information, including passwords, before posting.
    – T0xicCode
    Feb 1, 2015 at 0:43
  • 1
    You really should change that password on your database, right away. It's been out there on multiple questions you've asked. Feb 1, 2015 at 0:44
  • 1
    It's too late, you may have edited it, but it is viewable in the edit history. Change it on your database server ASAP!
    – Anil
    Feb 1, 2015 at 0:44
  • @DagurTidalwave Have you [started your session[(php.net/manual/en/function.session-start.php)? You need to call session_start() on every page that can load values from the SESSION array.
    – T0xicCode
    Feb 1, 2015 at 0:45
  • @T0xicCode yes, I've done that and it still doesn't work. Feb 1, 2015 at 0:54

2 Answers 2

0

1.) you have an closing} with no opening { :

...
  $row2 = mysqli_fetch_assoc($results2); 
  $seller = $row2['seller'];
  // } <<<<==== ????
  ?>
  ....

2.) you may start the session first:

session_start();
...
  $row2 = mysqli_fetch_assoc($results2); 
  $seller = $row2['seller'];
  // } <<<<==== ????
  ?>
  ....
0

Here is the problem with your code. You are selecting * from the 'lots' table without a specific constraint within a WHERE statement. When the query is ran you are only selecting the top row of whatever was returned from the 'lots' table. When the comparison is done between $seller and $_SESSION['user_id'] the $seller variable is ambiguous. Here is some updated code that may help.

Also...try to avoid using * in SQL statements. By selecting columns that you will be reading will reduce the amount of data that needs to be parsed. Plus, it's good practice.

$query2 = "SELECT * FROM lots WHERE <columnName> = {$_SESSION['user_id']}";
  $results2 = mysqli_query ($mysqli, $query2);
  $row2 = mysqli_fetch_assoc($results2); 
  $seller = $row2['seller'];
  }
  ?>
  <?php if ($accessLevel == 'Admin' || $seller == $_SESSION['user_id']) { ?>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.