登录后获取用户ID

Question

After successful login, I would like the function to keep the user_id, so the user can update their the profile in the database. In the database there are two rows called catchphrase and interest. Right now when I write something it creates a new column with user_id 0.

I get this error as well: Notice: Array to string conversion in

/Applications/XAMPP/xamppfiles/htdocs/modul8B/models/profile_table_class.php on line 23

Line 23 is:

$data = array ($catchphrase, $interest, $image);

Here's the code for inserting:

class Profile_Table {
    private $db; 

    public function __construct($pdo) {
        $this->db = $pdo; 
        ;
    }
        public function getProfileForUser($user_id){
        $sql = "SELECT user_id, catchphrase, interest, image FROM user
            WHERE user_id = ?";  
        $statement = $this->db->prepare($sql);
        $data = array( $user_id);
        $statement->execute($data);
        //print_r($statement);
        return $statement->fetchObject();
    }

    public function insertProfile($catchphrase, $interest, $image){
        $sql = "INSERT INTO user (catchphrase, interest, image) values ('".$catchphrase."', '".$interest."', '".$image."')";
        $statement = $this->db->prepare($sql);
        $data = array ($catchphrase, $interest, $image);  
        $statement->execute ($data);
        return $statement;      
    }

and here's the home page:

<?php
if ($siteVisitor->IsLoggedIn()) {
    //echo "catchphrase = $catchphrase<br>";
    include_once "models/profile_table_class.php";
    $profiles = new Profile_Table($db);
    $userId = $siteVisitor->getId();
    $profileData = $profiles->getProfileForUser($userId);

    //die();
    $homeOutput = include_once 'views/loggedIn.php';
    $homeOutput .= include_once "views/profile-list-html.php";
    $profileIsSubmitted = isset($_POST['profile-submit']);
    if ($profileIsSubmitted) {
        $catchphrase = $_POST['catchphrase'];
        $interest = $_POST['interest'];
        $image = $_FILES['image'];
        try {
            $profiles->insertProfile($catchphrase, $interest, $image);
        } catch (Exception $e) {
            $errorDescription = $e;
            echo $e;
        }
    }
    return $homeOutput;

Any help appreciated.

Answer 1

For the getProfileForUser method you are using a parameter for the user_id:

user_id = ?

And in the insertProfile method you are not:

('".$catchphrase."', '".$interest."', '".$image."')

Which is an inconsistency, and unsafe.
Using named parameters :name will make your code much more readable (more safe), so i would advice to use them if you want.
http://www.php.net/manual/en/pdostatement.bindparam.php

Here's the code for that:

public function getProfileForUser($user_id){
    $sql = "SELECT user_id, catchphrase, interest, image FROM user WHERE user_id = :user_id";  
    $statement = $this->db->prepare($sql);
    $parameters = array(
        ':user_id' => $user_id
    );
    $statement->execute($parameters);
    return $statement->fetchObject();
}

public function insertProfile($catchphrase, $interest, $image){
    $sql = "INSERT INTO user (catchphrase, interest, image) values (:catchprase, :interest, :image)";
    $statement = $this->db->prepare($sql);
    $parameters = array(
        ':catchprase' => $catchphrase,
        ':interest' => $interest,
        ':image' => $image
    );
    $statement->execute($parameters);
    return $statement;      
}

Another thing, do not upload files in your database which i think is causing your array to string error, upload only a reference to the image and move the file to an images directory in your app:

if ($siteVisitor->IsLoggedIn()) {
    include_once "models/profile_table_class.php";
    $profiles = new Profile_Table($db);
    $userId = $siteVisitor->getId();
    $profileData = $profiles->getProfileForUser($userId);

    //die();
    $homeOutput = include_once 'views/loggedIn.php';
    $homeOutput .= include_once "views/profile-list-html.php";
    $profileIsSubmitted = isset($_POST['profile-submit']);

    if ($profileIsSubmitted) {
        $catchphrase = $_POST['catchphrase'];
        $interest = $_POST['interest'];

        $image_directory = '/uploads'; // destination folder
        $image = $_FILES['image']; 
        $imageRef = '';

        if ($image['error'] < 0) {

            $image_tmp_name = $image['tmp_name'];
            $image_name = $image['name'];
            $imageRef = $image_directory .'/'. $image_name;

            // Move the file: Source, destination
            move_uploaded_file($image_tmp_name, $imageRef);
        }

        try {
            $profiles->insertProfile($catchphrase, $interest, $imageRef);
        } catch (Exception $e) {
            $errorDescription = $e;
            echo $e;
        }
    }
    return $homeOutput;