PHP错误未知

Question

So I have created a function:

function user_data($user_id) {
    $data = array();
    $user_id = (int)$unser_id;

    $func_num_args = func_num_args();
    $func_get_args = func_get_args();

    if ($func_num_args > 1){
        unset($func_get_args[0]);

        $fields = '`' . implode('`, `', $func_get_args) . '`';
        $data = mysql_fetch_assoc(mysql_query("SELECT $fields FROM `users` WHERE 'user_id' = $user_id"));


        return $data;
    }

}

By mistake I crated a typo unser_id but didnt relise up until I had to troubleshoot further along the line in my code.

I am creating a login script but the point in which I am having to troubleshoot is showing profile data from my other users.

The reason I point out the typo part is because it for some reason is a strange error. If I change it to user_id it will not allow me to login anymore. If I leave it as under_id it works.

I am having to troubleshoot because I believe this is the cause of the problem I am having trying to view other users profiles and showing their information and not mine which is happening right now.

For example, in my url www.mywebsite.com/myprofile shows my username and my email address, if I type in www.mywebsite.com/otherprofile it still shows my information. But it does show a query if I type a user that does not exist in my database so that part works.

I believe the issue all stems form this typo but am really stuck as to appraoch a resolve?

So here is the other code:

profile page:

if (isset($_GET['username']) === true && empty ($_GET['username']) === false) {
    $username = $_GET['username'];



    if (user_exists($username) === true) {
        $user_id  = user_id_from_username($username);   
        $profile_data = user_data($user_id, 'first_name', 'last_name', 'email');

    ?>


    <p><?php echo $profile_data['profile']; ?></p>

    <h1><?php echo $profile_data['first_name']; ?> profile</h1>
    <p><?php echo $profile_data['email'] ?></p>



    <?php

    } else {
        echo 'Sorry, that user does not exist';
    }
    } else {
        header('Location: index.php');
    exit();
}

Here all the related functions:

function logged_in(){
    return (isset($_SESSION['user_id'])) ? true : false;    
}


function user_exists($username) {
    $username = sanitize($username);
    $query = mysql_query("SELECT COUNT(`user_id`) FROM `users` WHERE `username` = '$username'");
    return (mysql_result($query, 0) == 1) ? true : false;
}

function email_exists($email) {
    $email = sanitize($email);
    $query = mysql_query("SELECT COUNT(`user_id`) FROM `users` WHERE `email` = '$email'");
    return (mysql_result($query, 0) == 1) ? true : false;
}




function user_active($username) {
    $username = sanitize($username);
    $query = mysql_query("SELECT COUNT(`user_id`) FROM `users` WHERE `username` = '$username' AND `active` = 1");
    return (mysql_result($query, 0) == 1) ? true : false;
}




function user_id_from_username($username) {
    $username = sanitize($username);
    return mysql_result(mysql_query("SELECT `user_id` FROM `users` WHERE `username` = '$username'"), 0, 'user_id'); 
}




function login($username, $password) {
    $user_id = user_id_from_username($username);

    $username = sanitize($username);
    $password = md5($password);

    return (mysql_result(mysql_query("SELECT COUNT(`user_id`) FROM `users` WHERE `username` = '$username' AND `password` = '$password' "), 0) == 1) ? $user_id : false;
}

Answer 1

The problem in your first function is that you are quoting your column name with single quotes:

$data = mysql_fetch_assoc(mysql_query("SELECT $fields FROM `users` WHERE 'user_id' = $user_id"));
                                                                         ^       ^

That means that you are not actually using the column user_id but a string.

You should change that to:

$data = mysql_fetch_assoc(mysql_query("SELECT $fields FROM `users` WHERE `user_id` = $user_id"));

(or without the backticks...).

Apart from that you are using the deprecated mysql_* functions and you don't have any error handling. You should switch to PDO or mysqli using prepared statements and make sure it throws exceptions (both can) so that you know exactly what goes wrong.