如何根据会话从数据库中获取数据？

Question

我有一个登录脚本，其中重定向页面是根据用户的角色制作的，所以如果它是管理员，它会转到 admin.php，如果它的测试员转到 tester.php，所以在第一个会话中用户角色已给出，并且在我的另一个名为 login 的会话中，我给出了用户名。在我的数据库中，我还有一些来自用户配置文件的内容，我想要的是用户登录时显示的名字和姓氏。

在这里你可以看到我的验证脚本。

<?php
            session_start();
            $mysqli=new MySQLi("localhost", "root", "root", "portfolio");
            $role="";

            $username=filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING);
            $password=filter_input(INPUT_POST, 'password', FILTER_SANITIZE_STRING);

            if($query=$mysqli->prepare("SELECT `role` FROM members WHERE username=? AND password=?"))
            {
            $query->bind_param("ss", $username, $password);
            $query->execute();
            $query->bind_result($role);
            $query->fetch();
            }
            else
            {
            echo "Errors in the Query. ".$mysqli->error;
            die();
            }

            if($role!="")
            {
                $_SESSION['ingelogt']=$username;
                $_SESSION['user_role']=$role;
                $location="$role.php"; // If role is admin this will be admin.php, if student this will be student.php and more.
                header("location: $location"); // Redirect to the respective pages.
            }
            else
            {
                echo "Invalid password, username combination";
            }
            ?>

这里是管理员成功登录后将被重定向的页面

<?php
            session_start();
            if(!isset($_SESSION['ingelogt']))
            {
                header("location: index.php"); // The user is not logged in. Redirect him to the login page.
            }

            $page_role="admin"; // This must be admin for admin.php and student for student.php and similar

            $role=$_SESSION['user_role'];

            if($role!=$page_role) // If student come to admin page by mistake or admin to student and similar
            {
                echo "You are not supposed to be here.";
                die();
            }

            $dom = new DOMDocument();
            libxml_use_internal_errors(true);
            $dom->loadHTMLFile("admin.html");
            libxml_use_internal_errors(false);

            if($_SESSION['user_role']) {
                $oUl = $dom->getElementById('navUl');
                    $oList = $dom->createElement('li');

                        $oLink = $dom->createElement('a');
                        $oLink->setAttribute('href','logout.php');

                            $oI = $dom->createElement('i');
                            $oI->setAttribute('class','icon-logout');

                            $oLink->appendChild($oI);

                        $oList->appendChild($oLink);

                    $oUl->appendChild($oList);
            }

            echo $dom->saveHTML();
            ?>

所以我想要的是当用户登录时，他的名字和姓氏将被显示。 我希望有人可以帮助我

更新的文件 验证.php

<?php
                session_start();
                // Making a connection with the database.
                $mysqli=new MySQLi("localhost", "root", "root", "portfolio"); 
                $role=""; 

                // Declaring the username and password input.
                $username=filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING); 
                $password=filter_input(INPUT_POST, 'password', FILTER_SANITIZE_STRING); 

                // If role from members where username and password from inputs exicts in database bind parameters.
                // If given parameters not excists in database die
                if($query=$mysqli->prepare("SELECT `id`,`role` FROM members WHERE username=? AND password=?")) {
                    $query->bind_param("ss", $username, $password);                                         
                    $query->execute();                                                                
                    $query->bind_result($id, $role);
                    $query->fetch();
                } else {                                                                                    
                    echo "Errors in the Query. ".$mysqli->error;                                            
                    die();
                }

                // If $role is filled make session for username to check if logged in and session role for redirect page.
                // If $role and $username is not filled invalid password, username combination.
                if($role!="") {                                                                           
                    $_SESSION['ingelogt']=$username;                                                        
                    $_SESSION['user_role']=$role;       
                    $_SESSION['user_id']=$id;                                           
                    $location="$role.php";                                                                  
                    header("location: $location");                                                          
                } else {                                                                                   
                    echo "Invalid password, username combination";                                          
                }
            ?>

和 admin.php

                <?php
                session_start();
                // If session is not ingelogt lead back to index.php.
                if(!isset($_SESSION['ingelogt'])) {
                    header("location: index.php"); 
                }

                // The role that has access to this page.
                $page_role="admin"; 
                $role=$_SESSION['user_role'];
                // If a user with a different role visits wrong page.
                if($role!=$page_role)
                {
                    echo "You are not supposed to be here.";
                    die();
                }

                // Start new DOMDocument and load html file.
                $dom = new DOMDocument();
                libxml_use_internal_errors(true);
                $dom->loadHTMLFile("admin.html");
                libxml_use_internal_errors(false);

                // If user is logged in add logg out icon in the menu.
                if($_SESSION['ingelogt']) {
                    $oUl = $dom->getElementById('navUl');
                        $oList = $dom->createElement('li');

                            $oLink = $dom->createElement('a');
                            $oLink->setAttribute('href','logout.php');

                                $oI = $dom->createElement('i');
                                $oI->setAttribute('class','icon-logout');

                                $oLink->appendChild($oI);

                            $oList->appendChild($oLink);

                        $oUl->appendChild($oList);
                }
                // Save DOMDocument with html document.
                echo $_SESSION['user_id'];
                echo $dom->saveHTML();
            ?>

Answer 1

您想要的是将用户 ID 保留在 $_SESSION 中，因此请修改您的查询：

 SELECT `id`,`role` FROM members WHERE username=? AND password=?

然后，和你添加$role的方法一样，添加$id，

 $_SESSION['userID'] = $id;

然后在下一个页面，你可以使用$_SESSION['userID']查询你需要的信息。

作为旁注，请考虑使用password_hash()，这样您的密码就不会以明文形式存储在数据库中。

Answer 2

在这里，您只需要一个会话变量来存储用户的拳头和姓氏。

更改 SELECT 查询；

"SELECT `role`,'firstname','lastname' FROM members WHERE username=? AND password=?"

如果查询返回任何原始数据，即。对于有效用户。

将这些值存储在 Session 中并在所有其他页面中使用它来显示名字和姓氏，然后再显示。

Answer 3

您可以从 db 中获取名字和姓氏，并且存储为 SESSION：

<?php
            session_start();
            $mysqli=new MySQLi("localhost", "root", "root", "portfolio");
            $role="";

            // add lastname & firstname
            $lastname="";
            $firstname="";

            $username=filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING);
            $password=filter_input(INPUT_POST, 'password', FILTER_SANITIZE_STRING);

            // get lastname & first name with select
            if($query=$mysqli->prepare("SELECT `role`,`firstname`,`lastname` FROM members WHERE username=? AND password=?"))
            {
            $query->bind_param("ss", $username, $password);
            $query->execute();
            $query->bind_result($role,$firstname, $lastname);
            $query->fetch();
            }
            else
            {
            echo "Errors in the Query. ".$mysqli->error;
            die();
            }

            if($role!="")
            {
                $_SESSION['ingelogt']=$username;
                $_SESSION['user_role']=$role;

                // save to session
                $_SESSION['user_lastname']=$lastname;
                $_SESSION['user_firstname']=$firstname;

                $location="$role.php"; // If role is admin this will be admin.php, if student this will be student.php and more.
                header("location: $location"); // Redirect to the respective pages.
            }
            else
            {
                echo "Invalid password, username combination";
            }
?>

然后在管理页面上，从 SESSION 中提取名称并放在需要的页面上。