PHP - Members Profile

I'm trying to set up a very simple (WIP) members page that you can click registered users to see their profile page that will display basic information.

I'm having trouble with the sessions and retrieving this info from my database. I'm very new to this so it's all pretty amateur.

I've been looking at this code for several hours trying to fix things but I start to make some progress, then change stuff, and go backwards. I had a members page that displayed the registered users in my database, but after a while of altering to try to get the profiles to work, I messed it up :mad:. I have basic login and register pages.

I need some seperate eyes to take a look. Any help is so much appreciated. Thanks!


members.php
Code: [Select]
<?php
session_start();
require 'mysql-connect.php';
$auser=$_SESSION['user'];


if(isset($auser)){
$Members = mysql_query("SELECT * FROM user WHERE username='$username'") or die(mysql_error());
$numRowsMembers = mysql_num_rows($Members);

?>

<table border="1">

<?php
for($count = 1; $count <= $numRowsMembers; $count++)
{
    $name = mysql_fetch_array($Members);
    ?>
   
    <tr>
    <?php
    echo '<td><a href="member_profile.php?username=' . $name['username'] . '">' . $name['username'] . '</a></td>';
}
}
   ?>
 
    </tr>
</table>

member_profile.php
Code: [Select]
<?php
session_start();
require 'mysql-connect.php';
$auser=$_SESSION['user'];

if(isset($auser)){

$username = $_GET['username'];
$user = mysql_query("SELECT * FROM user WHERE username = '$username'");
echo $user;
$user=mysql_fetch_assoc($user);


echo "<h1>User Info</h1>";

echo "<b>Username:".$user['username']."<br>";

echo "<br>";
  echo '<form name="backlistfrm" method="post" action="members.php">';
echo '<input type="submit" value="Back to The List">';
echo '</form>';
echo "<br>";
}
?>

my login handler
Code: [Select]
<?php
include 'mysql-connect.php';

$username = $_POST['user'];
$password = $_POST['pass'];
$query1 = mysql_query("SELECT * FROM user WHERE username='$username'");
$result = mysql_num_rows($query1);
if($result == 0)
{
echo '<h1>Error!</h1>The username you specified does not exist!';
}
else
{

$checkuser = mysql_query("SELECT * FROM user WHERE username='$username'");

                        $row = mysql_fetch_array($checkuser);
                                                        $password2 = $row['password'];
                                                        //$status = $row['status'];
                                if ($password == $password2)
                                        {
                                 echo "Hi $username.";
 include("index.php"); 
                                        }
                                else
                                        {
                                        echo '<h1>Error!</h1>The username and password combination you entered does not match the ones we have in the database.';
                                        }

}
?>
mysql-connect.php
Code: [Select]
<?php

$host = "localhost";
    $username = "root";
    $password = "";
    $database = "ug54";
    $link = mysql_connect($host, $username, $password);//Connects to database with host, username, and password
    $select = mysql_select_db($database);
?>
and my simple database
Code: [Select]
CREATE TABLE IF NOT EXISTS `user` (
  `id` int(4) unsigned NOT NULL AUTO_INCREMENT,
  `username` varchar(32) NOT NULL,
  `password` varchar(32) NOT NULL,
  `firstname` varchar(20) NOT NULL,
  `lastname` varchar(20) NOT NULL,
  `email` varchar(30) NOT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB  DEFAULT CHARSET=latin1 AUTO_INCREMENT=7 ;

--
-- Dumping data for table `user`
--

INSERT INTO `user` (`id`, `username`, `password`, `firstname`, `lastname`, `email`) VALUES
(1, '', '', '', '', '0'),
(2, 'abc', '123', '', '', '0'),
(3, 'a', 'b', 'c', 'd', '0'),
(4, 'hfg', 'rgfdg', 'gdfg', 'dfgdf', '0'),
(5, '999', '999', '999', '999', '999');

Hi all,

I am currently facing a problem, if you look at 'viewprofile.jpg' attachment, you can see that there is an uploaded profile picture.

However when I click to edit the profile, the picture is missing (editprofile.jpg), I am just wondering what went wrong? Can someone guide me in troubleshooting this problem?


Code: [Select]
<?php
if (isset($_POST['submit'])) {
  
    // Validate and move the uploaded picture file, if necessary
if (!empty($new_picture)) {
      if ((($new_picture_type == 'image/gif') || ($new_picture_type == 'image/jpeg') || ($new_picture_type == 'image/pjpeg') ||
        ($new_picture_type == 'image/png')) && ($new_picture_size > 0) && ($new_picture_size <= CT_MAXFILESIZE)) {
        //0 indicates a success, other values indicate failure
if ($_FILES['file']['error'] == 0) {
          // Move the file to the target upload folder
          $target = CT_UPLOADPATH . basename($new_picture);
          if (move_uploaded_file($_FILES['new_picture']['tmp_name'], $target)) {
            // The new picture file move was successful, now make sure any old picture is deleted
            if (!empty($old_picture) && ($old_picture != $new_picture)) {
              @unlink(CT_UPLOADPATH . $old_picture);
            }
          }
          else {
            // The new picture file move failed, so delete the temporary file and set the error flag
            @unlink($_FILES['new_picture']['tmp_name']);
            $error = true;
            echo '<p class="error">Sorry, there was a problem uploading your picture.</p>';
          }
        }
      }
      else {
        // The new picture file is not valid, so delete the temporary file and set the error flag
        @unlink($_FILES['new_picture']['tmp_name']);
        $error = true;
        echo '<p class="error">Your picture must be a GIF, JPEG, or PNG image file no greater than ' . (CT_MAXFILESIZE / 1024). '</p>';
      }
    }


// Grab the profile data from the POST
    $name = mysqli_real_escape_string($dbc, trim($_POST['name']));
    $nric = mysqli_real_escape_string($dbc, trim($_POST['nric']));
    $gender = mysqli_real_escape_string($dbc, trim($_POST['gender']));
    

    $old_picture = mysqli_real_escape_string($dbc, trim($_POST['old_picture']));
    $new_picture = mysqli_real_escape_string($dbc, trim($_FILES['new_picture']['name']));
    $new_picture_type = $_FILES['new_picture']['type'];
    $new_picture_size = $_FILES['new_picture']['size']; 
    list($new_picture_width, $new_picture_height) = getimagesize($_FILES['new_picture']['tmp_name']);


    $error = false;

    

    // Update the profile data in the database
    if (!$error) {
      if (!empty($name) && !empty($nric) && !empty($gender)) {
        
$query = "UPDATE tutor_profile SET name = '$name', nric = '$nric', gender = '$gender' WHERE tutor_id = '" . $_GET['tutor_id'] . "'";

mysqli_query($dbc, $query)
or die(mysqli_error($dbc));

        // Confirm success with the user
        echo '<p>Your profile has been successfully updated. Would you like to <a href="viewprofile.php?tutor_id=' . $_GET['tutor_id'] . '">view your profile</a>?</p>';

        mysqli_close($dbc);
        exit();
      }
      else {
        echo '<p class="error">You must enter all of the profile data (the picture is optional).</p>';
      }
    }
  } // End of check for form submission
  else {
    // Grab the profile data from the database
    $query = "SELECT name, nric, gender FROM tutor_profile WHERE tutor_id = '" . $_GET['tutor_id'] . "'";
    
$data = mysqli_query($dbc, $query)
or die(mysqli_error($dbc));

// The user row was found so display the user data
if (mysqli_num_rows($data) == 1) {
$row = mysqli_fetch_array($data);

    if ($row != NULL) {
      $name = $row['name'];
      $nric = $row['nric'];
      $gender = $row['gender'];
    }
    else {
      echo '<p class="error">There was a problem accessing your profile.</p>';
    }
  }
  }

  mysqli_close($dbc);
?>

  <form enctype="multipart/form-data" method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>">
    <input type="hidden" name="MAX_FILE_SIZE" value="<?php echo CT_MAXFILESIZE; ?>" />

<ul id="tabSet_ep">
<li><a href="#panel1">Personal Profile</a></li>
<li><a href="#panel2">Qualifications</a></li>
<li><a href="#panel3">Tutor\'s Comments/Commitment</a></li>
<li><a href="#panel4">Tutoring Levels/Subjects</a></li>
</ul>

<!--Personal Profile-->
<div id="panel1">
      <label for="new_picture">Pictu </label>
      <input type="file" id="new_picture" name="new_picture" />
      <?php if (!empty($old_picture)) {
        echo '<img class="profile" src="' . CT_UPLOADPATH . $old_picture . '" alt="Profile Picture" />';
      } ?><br />
  <label for="firstname">First name:</label>
      <input type="text" id="firstname" name="firstname" value="<?php if (!empty($name)) echo $name; ?>" /><br />
      <label for="lastname">Last name:</label>
      <input type="text" id="lastname" name="lastname" value="<?php if (!empty($nric)) echo $nric; ?>" /><br />
      <label for="gender">Gender:</label>
      <select id="gender" name="gender">
        <option value="M" <?php if (!empty($gender) && $gender == 'M') echo 'selected = "selected"'; ?>>Male</option>
        <option value="F" <?php if (!empty($gender) && $gender == 'F') echo 'selected = "selected"'; ?>>Female</option>
      </select><br />
    </div>

    <input type="submit" value="Save Profile" name="submit" />
  </form>

I created a field in "b_users" table as "banned" with default value="no". i.e, all members by default are set to "banned"="no". I was testing this code in my some pages to ban member and prevent access to my pages:

$getid="SELECT * from b_users where id='$user_id'";
if($getid[banned]=="yes")
 {
  die("<center>You have been banned from posting</center>");
 } 
else
{
show page
Above code is banning all members. But i want to show ban message to members who's "banned" field value is set to "yes" only. How to do that?

$_GET["find"] displays all users including the current user. The current user should not be displayed.

I would like to display members that are NOT friends with the current user. Do I need to join the tables to make this work?

$_GET["add"] inserts "screen_name" into "member and friendwith"

Code: [Select]
<?php
if(isset($_GET["find"]))
 {
$username = $_POST["screen_name"];
$query = "SELECT * FROM users WHERE screen_name LIKE '%$username%'";
$result = mysql_query($query);
$exist = mysql_num_rows($result); 
if($exist=='0')
{
 echo "No match found";
}
else 
{
 echo "Matches for search: $username<br>";
 while($currow = mysql_fetch_array($result))
 {
 ?>
<a href="users/member?addfriend=<?php echo $currow['screen_name']; ?>"><img src="avatars/<?php echo $currow["image"]; ?>" ></a>
<?php
 }
}
 }
 
 if(isset($_GET["add"]))
 { 
$username = $_SESSION["screen_name"];
$friend = $_GET["add"];
$query = "SELECT * FROM friends WHERE member='$username' AND friendwith='$friend'";
$result = mysql_query($query);
$exist = mysql_num_rows($result); 
if($exist=='0')
{
 $query = "INSERT INTO friends(member,friendwith) VALUES('$username','$friend')";
 mysql_query($query);
 echo "$friend is now your friend!";
}
else 
{
 echo "$friend is already your friend!";
} 
 }
?>

i been working on my view Members page for a while now i can't seem to get it to work right

this is how i shows up for me


and i want it to show up like this


i think it has something to do with the loop, but have no idea how to fix this :S



<?php
require_once('settings.php');
checkLogin('1 2');


$Members = mysql_query("SELECT * FROM users") or die(mysql_error());

$numRowsMembers = mysql_num_rows($Members);
?>

<?php
for($count = 1; $count <= $numRowsMembers; $count++)
{
    $name = mysql_fetch_array($Members);


?>
<table border=2>
<tr><td><img src="<? echo $name['main_P']?>" width="50" height="50"/>
<a href="view_profile.php?username=<? echo $name['Username']?>"><? echo $name['Username']?></a>

<?

$onlinestatus = $name['ON_OFF'];

if ( $onlinestatus == OFFLINE ) {
echo "";
} else {
echo "<font color=green>Online Now!</font>";
}
?>

</td></tr></table>

<?
}
?>