查询行取决于登录

Question

I'm trying to echo some data from a table which is only relevant to whoever is logged in. For example, if I have a table: ID-username-password-avatar and I want to display the avatar for the person that's logged in, how can I go about doing that? So far I have managed to echo the first avatar in the first row no matter who's logged in.

This is my session code:

<?php
session_start();
if (!isset($_SESSION['myusername']))
{
  header('Location:login.php');
}

This is my attempt at getting the row based on which user is connected using

  FROM login WHERE username='$name'"

  $conn = new PDO("mysql:host=MYHOST;dbname=MYDBNAME", "NAME", "PASSWORD");
  $name =  "demo"; $stmt = $conn->query("SELECT * FROM login WHERE username='$name'");
  $stmt->execute();
  $row = $stmt->fetch(PDO::FETCH_OBJ);
  $wm = array('avatar' => $row->avatar);
?>

Answer 1

Put your name in the $_SESSION['myusername'] superglobal. Then you can fetch it from any page until the session's been destroyed.

In your code:

$_SESSION['myusername'] = $name;

Similar to this, you can put an image path as well and display an avatar.

Edit

Just to improve my answer a little bit more, I'll give you a complete example of the login form.

Let's say we have an (X)HTML form like in the following code, you can call it "login.php":

<form action="login.php" method="post">
  <dl>
    <dt>Username:</dt>
      <dd><input type="text" name="username"/></dd>
    <dt>Password:</dt>
      <dd><input type="text" name="password"/></dd>
    <dt><input type="submit"/></dt>
  </dl>
</form>

Now when you have the (X)HTML code, you add the necessary PHP code:

<?php

if( isset($_POST["username"]) )
{
  $username = $_POST["username"];
  $password = $_POST["password"];
  $connection = new mysqli("host", "name", "password", "dbname");
  $connection->set_charset("utf8");
  $username = $connection->real_escape_string($username); //Security
  $password = $connection->real_escape_string($password); //Security
  $result = $connection->query("SELECT * FROM login WHERE username LIKE BINARY '$username' AND password LIKE BINARY '$password'");
  if($result->num_rows==1)
  {
    $_SESSION['myusername'] = $username;
    $row = $result->fetch_assoc();
    $_SESSION['myavatar'] = $row["avatar"];
  }
  $connection->close();
}

?>

<form action="login.php" method="post">
  <dl>
    <dt>Username:</dt>
      <dd><input type="text" name="username"/></dd>
    <dt>Password:</dt>
      <dd><input type="text" name="password"/></dd>
    <dt><input type="submit"/></dt>
  </dl>
</form>

Now you open a page you want to protect with username and password and enter PHP code similar to the following. You can do with your avatar whatever you want on any page that has the session code.

<?php
  session_start();
  if ( !isset($_SESSION['myusername']) )
  {
    header("Location:login.php");
  }

  echo $_SESSION['myavatar'];
?>

Depending on the user that's logged in, a different avatar will be shown.