显示登录的特定用户的删除按钮

Question

I am trying that the user who is logged in can delete his own posts so only he should see the delete button on his posts. I was thinking by my own that I had to bind the user who is logged in to the posts/img ID and then he should see the button. I'm struggling with this a bit so every useful comment is appreciated!

PHP

<?php
$result = $mysqli->query("SELECT users.user_id, users.username,
                                picas.img_id, picas.user_id, picas.name, picas.description, picas.created_at
                          FROM users
                          JOIN picas ON users.user_id = picas.user_id
                          ORDER BY picas.created_at DESC");


while($pica = $result->fetch_assoc()) {

$ses_user = $_SESSION['username'];

echo '<div class="image_post">';

if(isset($ses_user) == $pica['user_id'] && $pica['img_id']) {
  echo '<form action="logic/delete_post.php?id='.$pica['img_id'].'" method="POST">
          <input type="hidden" name="id" value="?id='.$pica['img_id'].'" />
          <input type="submit" name="deleteSubmit" value="Delete" class="delete_post" />
        </form>';
}


    echo '<div class="user_avatar"><img src="avatars/'.$pica['username'].'.jpeg" /></div>
                <div class="user_name">'.$pica['username'].'</div> <br><br><br><br>
                <div class="timeago">'.$diff.'</div>
                <div class="image_description">'.$pica['description'].'</div>
                <img src="'.$pica['name'].'" />

          <div class="clear"></div>
        </div>';

}

?>

Answer 1

Your problem is that you are checking isset($ses_user) == $pica['user_id'] being isset() a function that returns a bool.

What you want to check is if the current user is the owner.

The correct condition should be:

...

if(isset($ses_user) && ($ses_user == $pica['username']) && $pica['img_id']) {
echo '<form action="logic/delete_post.php?id='.$pica['img_id'].'" method="POST">
      <input type="hidden" name="id" value="?id='.$pica['img_id'].'" />
      <input type="submit" name="deleteSubmit" value="Delete" class="delete_post" />
    </form>';
}
...