检查是否用户，然后检查是否成员

Question

So I'm checking whether the person accessing the page is a user then redirecting them to the signup page if they're not.

Then I'm checking whether the user is a member ( paid subscription ) if not then redirect to the user page.

The redirecting for the non users work But with the code below, noone can get access to the membership page because of the is_member check

<?php
error_reporting(0);
session_start();
include('connect.php');
ob_start();

if(!isset($_SESSION['username']))
{
    header("**********");
}
else
{
    $username =$_SESSION['username']  ;
}
$check = $mysqli->query("SELECT is_Member FROM users WHERE username = $username");
$row = mysql_fetch_assoc($check);
$isMember = $row['is_member'];
if ($isMember == 0){
    header("*************");
}

is_member is either a 1 or a 0: 1 meaning they are a member

Connect file:

<?php
$servername = "*****";
$user = "*****";
$password = "*****";
$dbname = "******";

$mysqli = new mysqli($servername, $user, $password, $dbname); //used to connect to the database

if ($mysqli->connect_error) {
     die('Error : ('. $mysqli->connect_errno .') '. $mysqli->connect_error);
}
?>

Answer 1

This

WHERE username = $username");

If the variable is a string (i.e.: "john", then it should be wrapped in quotes:

WHERE username = '$username'");

Then you're using a mysql_ function mysql_fetch_assoc which does not intermix with any other MySQL API than its own.

It must read as mysqli_fetch_assoc with the added i for the function.

Consult these following links http://php.net/manual/en/mysqli.error.php and http://php.net/manual/en/function.error-reporting.php and apply that to your code.

You should also add exit; after each header, otherwise you code may want to continue executing.

Another thing; your code is prone to an SQL injection. It's best that you use a prepared statement.

• https://en.wikipedia.org/wiki/Prepared_statement