无法从MySQL（php）获取数据（重新编辑）

Question

I have realized why i can't actually access userdata (after i am logged) old way to find the username is $_SESSION['username']; (assuming there is a row as 'username' in MySQL database)

So as i have a test account as "good25" (reason to choose numbers was to see if Alphanumeric inputs works fine.. its just checkup by me.. nevermind)

Problem : assuming, i have rows in a table as 'username' and all of his information.. such as 'password', 'email', 'joindate', 'type' ...

On net i found out how to snatch out username from Session <?php session_start(); $_SESSION('username'); ?>

successful!!

i had an idea to check if session is actually registering or no?? after a log on start.php i used this code if(isset($_SESSION['username'])) { print_r($_SESSION['username']); }

the result was "1" (while i logged in using this username "good25") any suggestions?

index.php (lets say, index.php just holds registration + Login form + registration script.. in login form, action='condb.php')

<?php 
require 'condb.php';

if (isset($_POST['btn-signup']))
{
    //FetchInputs
    $usern = mysqli_real_escape_string($connection,$_POST['username']);
    $email = mysqli_real_escape_string($connection,$_POST['email']);
    $password = mysqli_real_escape_string($connection,$_POST['password']);
    $repassword = mysqli_real_escape_string($connection,$_POST['repassword']);

    $usern = trim($usern);
    $email = trim($email);
    $password = trim($password);
    $repassword = trim($repassword);

    //SearchUser
    $searchusr = "SELECT username FROM $user_table WHERE username='$usern'";
    $usersearched = mysqli_query($connection, $searchusr);
    $countuser = mysqli_num_rows($usersearched);
    //SearchEmail
    $searcheml = "SELECT email FROM $user_table WHERE email='$email'";
    $emlsearched = mysqli_query($connection, $searcheml);
    $counteml = mysqli_num_rows($emlsearched);

    //RegisteringUser
    if ($countuser == 0)
    {
        if ($counteml == 0)
        {
            $ctime = time();
            $cday = date("Y-m-d",$ctime);
            $aCode = uniqid();
            $adduser = "INSERT INTO $user_table(username, email, password, realname, activationcode, verified, joindate, type, points) VALUES ('$usern','$email','$password','$name','$aCode','n','$cday','Free',$signPoints)";
            if (mysqli_query($connection, $adduser))
            {
                ?><script>alert('You have been registered');</script><?php
            }
            else {
                ?><script>alert('Couldnt Register, please contact Admin<br><?mysqli_error($connection);?>');</script><?php
            }
        } else {
            ?><script>alert('Email already exists!');</script><?php
        }
    } else {
        ?><script>alert('Username already exists!');</script><?php
    }
}
?>

condb.php

    $connection = mysqli_connect($db_server, $db_user, $db_pass);
mysqli_select_db($connection, $db_name);
if(!$connection) {
    die ("Connection Failed: " . mysqli_connect_error);
}

if (isset($_POST['btn-login']))
{
    $uname = mysqli_real_escape_string($connection,$_POST['uname']);
    $upass = mysqli_real_escape_string($connection,$_POST['upass']);

    //FindUser
    $finduser = "SELECT * FROM $user_table WHERE username='$uname' AND password='$upass'";
    $findinguser = mysqli_query($connection,$finduser);

    $founduser = mysqli_num_rows($findinguser);
    //ConfirmPassword
    if ($founduser > 0)
    {
        session_start();
        $_SESSION['username'] = $username;
        $_SESSION['username'] = true;
        if ($findinguser != false)
        {
            while ($fetchD = mysqli_fetch_array($findinguser, MYSQLI_ASSOC))
            {
                $fetchD['username'] = $usernn;
                $fetchD['email'] = $email;
                $fetchD['userid'] = $uid;
                $fetchD['realname'] = $rlnm;
                $fetchD['points'] = $pts;
                $fetchD['type'] = $membertype ;
            }
            header("Location: start.php");
        } else {
            echo mysqli_error();
        }
    } else {
        header("Location: index.php");
        ?><script>alert('Wrong details, please fill in correct password and email');</script><?php
    }
}

I am not asking you to build a script.. just little help please? (Thank you so so so so so much, as i am a self-learner, you don't have to say everything.. just a clue is enough for me)

Answer 1

may be you can try this code

<?php
    require_once 'require.inc.php';
    //session_start();

    if (isset($_POST['btn-login']))
    {
        $uname = mysqli_real_escape_string($_POST['uname']);
        $upass = mysqli_real_escape_string($_POST['upass']);

        $search = mysqli_query($connection, "SELECT username, userid, password from $user_table WHERE username='$uname' AND password='$upass'");
        $match = mysqli_fetch_assoc($search);
        if ($match == 1 and $match['password'] == md5($upass))
        {
            $_SESSION['username'] = $match['userid'];
        } else {
            ?>
            <script>alert('Password or E-mail is wrong. If you havent registered, Please Register');</script>
            <?php
        }
    }
    if (isset($_SESSION['username']) or isset($match['userid'])){
    header("Location:start.php");
    }
    if (isset($_POST['btn-signup']))
    {
        $name = mysqli_real_escape_string($_POST['name']);
        $usern = mysqli_real_escape_string($_POST['username']);
        $email = mysqli_real_escape_string($_POST['email']);
        $password = mysqli_real_escape_string($_POST['password']);
        $repassword = mysqli_real_escape_string($_POST['repassword']);

        $name = trim($name);
        $usern = trim($usern);
        $email = trim($email);
        $password = trim($password);
        $repassword = trim($repassword);

        $query = "SELECT email FROM $user_table WHERE email='$email'";
        $result = mysqli_query($connection, $query);
        $count = mysqli_num_rows($result);

        $querytwo = "SELECT username FROM $user_table WHERE username='$usern'";
        $resulttwo = mysqli_query($connection, $querytwo);
        $counttwo = mysqli_num_rows($resulttwo);


        if ($count == 0 AND $counttwo == 0) 
        {
            if ($password == $repassword) {
                if (mysqli_query($connection, "INSERT INTO $user_table(username, email, password, realname) VALUES ('$usern','$email','$password','$name')"))
                {
                    ?>
                    <script> alert ('Successfully registered'); </script>
                    <?php
                }
            }else {
                ?>
                <script> alert ('The Password you entered, doesnt match.. Please fill in the same password'); </script>
                <?php
            }
        }
        else {
            ?>
            <script> alert('Username or E-mail already exist'); </script>
            <?php
        }
    }
?>

and this is for require.inc.php

<?php
    global $username;
    //require 'dconn.php';
    session_start();

    $_SESSION["username"] = $username;

    $connection = mysqli_connect("localhost","root","", "test") or die(mysqli_error());


    // Check Login
    if (isset($_SESSION['username']) and isset ($match['userid']))
    {
    $Selection = "SELECT * FROM $user_table WHERE username='$username'";
    $selectQuery = mysqli_query($connection, $Selection);

        if ($selectQuery != false)
        {
            while ($fetchD = mysqli_fetch_assoc($selectQuery))
            {
                $usernn = $fetchD['username'];
                $email = $fetchD['email'];
                $uid = $fetchD['userid'];
            }
        } else {
            echo mysqli_error();
        }

    }
?>