Question

could someone please advise what is going wrong here?

my username is: System

In my inbox, I have 2 messages.
1 was sent to System and the other was sent to system.

I can delete the System mail, but when I try to delete the system message,
it gives me the ‘not your message’ error from my code.

here is the delete code from the view message page:

$delmsg=$_GET['delete'];

$idcheck = mysql_query("SELECT * FROM `inbox` WHERE `id`='$delmsg'");
$idfetch = mysql_fetch_object($idcheck);


    if ($delmsg !=''){
      if ($idfetch->to != $username){
         $errormsg = "Error - This is not your message to delete. Returning to your inbox... ";
         echo "<meta http-equiv=Refresh content=1;url=messages.php>";
      }else{
mysql_query("DELETE FROM `inbox` WHERE `to`='$username' AND `id`='$delmsg'");
         $errormsg = "Message deleted. Returning to your inbox...";
         echo "<meta http-equiv=Refresh content=1;url=messages.php>";
}
}

and here is the code from the send a message page:

if(strip_tags($_POST['send'])){

    $recipient= $_POST['sendto'];
    $subjectmsg= $_POST['subject'];
    $msgfull= $_POST['messagetext'];
    $date = date('Y-m-d H:i:s');

      if (!$recipient){
        $errormsg=" You must enter a recipient or your recipient's username must contain 3 or more characters. ";

    }elseif ($msgfull =="" || !msgfull){
        $errormsg="You cannot send a blank message. Please type your message in the text area above.";

    }elseif ($recipient && $msgfull){
        $checker=mysql_query("SELECT * FROM `user` WHERE `username`='$recipient'");
        $checkrows=mysql_num_rows($checker);

          if ($checkrows =="0"){
              $errormsg="User does not exist. Please check your SEND TO field";


    }elseif (!$subjectmsg){
    mysql_query("INSERT INTO `inbox` (`id`, `to`, `from`, `message`, `date`, `read`, `saved`, `subject`) VALUES 
                                     ('', '$recipient', '$username', '$msgfull', '$date', '0', '0', 'No Subject')");
                                     echo "<meta http-equiv=Refresh content=0;url=messages.php>";
    }else{
    mysql_query("INSERT INTO `inbox` (`id`, `to`, `from`, `message`, `date`, `read`, `saved`, `subject`) VALUES 
                                     ('', '$recipient', '$username', '$msgfull', '$date', '0', '0', '$subjectmsg')");
                                     echo "<meta http-equiv=Refresh content=0;url=messages.php>";
    }}
}

Both ‘username’ in the USER table and ‘to’ in the INBOX table are set to latin, varchar(255) if that helps.

Answer 1

Change the following line:

if ($idfetch->to != $username){

to:

if (strtolower($idfetch->to) !== strtolower($username)){

Using strtolower() to convert both the Name in the database and the Message name to lowercase before a comparison. Also changed (!=) to (!==) because we want an absolute match of type and value.

It’s not a perfect solution, but its one option without changing alot of code.