Question

I am making a website where a user can create an account and then log in. Once logged in the user should be able to change the information they registered with.

When the user logs in their username is passed in the URL like below:

header("Location: loggedon.php?$username");

Now, on my loggedon.php page I have added this:

<?php
$username = $_GET["username"];
$query="SELECT * FROM customer WHERE username=['$username']"; 
$result = mysql_query ($query) or die ("error in query"); 

while ($row = mysql_fetch_array($result)) 
{ 
// Print one row of results 
print "<tr>" . 
"<td>" . $row["CustomerID"] . "</td>" . 
"<td>" . $row["Firstnames"] . "</td>" . 
"<td>" . $row["Surname"] . "</td>" . 
"<td>" . $row["Username"] . "</td>" . 
"<td>" . $row["Email"] . "</td>" .
"<td>" . $row["Password"] . "</td>" .
//print a change/delete link at the end of each row
                "<td><a href=customerChangeDelete.php?id=".$row['CustomerID'].">Change/Delete</a></td>";                    
print "</tr>"; 
} 
// Then, finish the table
print "</table>";
}
?>

When I run the page and log in I get the following errors:

Notice: Undefined index: username in J:\xampp\htdocs\loggedon.php on line 60

error in query

I presume I have made some sort of mistake when trying to extract the username from the URL (?). If anyone could please give me a push in the right direction that would be amazing. Thanks.

Answer 1

Why not try with mysql_real_escape_string? It would be safer.

In other hand with “Location: loggedon.php?$username” you are getting an url like:

loggedon.php?john

but, for $_GET you should get a url like:

loggedon.php?username=john

I recommend you change

header("Location: loggedon.php?$username"); 

with:

header("Location: loggedon.php?username=".$username);