PHP - How Do I Retrieve Inserted Values From Mysql Database With Respect To A User Id In Php?

Ugh. Ive been asking so many questions, betcha already know my name. Hahah.
Anyways, I know I already asked a question like this, but this is different.
One of the values I am trying to insert into a database is simply not working.
Here is the columnes in my mysql database:

c_id   commet       story   user      date_added   star
Every value but 'commet' is getting inserted into database.  NO error, no mysql errror. I have racked my brain trying to figure out what is wrong with the script.
Here is my code:
Code: [Select]
<?php
$idget = $_GET['id'];
mysqlConnect();
//submit story
if(isset($_POST['submit']))
{
   $com_form = mysql_real_escape_string(bb($_POST['commet']));
   $rat_form = $_POST['rat'];
   $story_form =  $idget;
   $user = $_SESSION['user'];
   $date = date("Y-m-d");
   $query1 = "
   INSERT INTO story_commets(star, story, user, date_added, commet)
   VALUES($rat_form, '$story_form', '$user', '$date', '$com_form')
   ";
   mysql_query($query1) or die(mysql_error());


      
      
   //}
}

// desplay reviews


$query3 = "
SELECT * FROM story_commets
WHERE story = '$idget'
ORDER BY date_added
";
$select3 = mysql_query($query3) or die(mysql_error());
//$x=1;
$ratav = array();
//if(mysql_num_rows($select3) == 0)
//{
   echo '<div id="message"> No Reviews Yet.... <>';
   
//}
//else
//{
while($rows3 = mysql_fetch_assoc($select3))
{
   
   
   $commetdb = $rows3['commet'];
   $user_com_db = $rows3['user'];
   $datedb = $rows3['date_added'];
   $stardb = $rows3['star'];
   //get profile picture
   $query4 = "
   SELECT * FROM login_info
   WHERE user = '$user_com_db'
   ";   
   $select4 = mysql_query($query4) or die(mysql_error());
   
   $rows4 = mysql_fetch_assoc($select4) or die(mysql_error());
      $profile_pic = $rows4['profile_picture'];
      $user_id = $rows4['id'];
   echo "
   <div class='rev_cont'>
   <div class='info'>
   <img src='$profile_pic' /> 
   <a href=?p=profile&id=$user_id> $user_com_db </a> 
   

   
   <> <br /> 
   <div class='rev'>
   <strong> $stardb/10 </strong> <br />
   $commetdb
   <> 
   <div id='date'>  <em> Date Added: $datedb </em> <> 
   <>
   <hr />
   
   
     ";
   
   $ratav[]=$stardb; 
   
     
     
}




$sum = array_sum($ratav);

$count = count($ratav);
$av = $sum / $count;
$avf = round($av, 1);
echo"<div id='message'> Rating Avarage: $avf /10 <>";
//}
if (isset($_SESSION['user']))
{
   echo"
   <p> Did you like this story? Did you hate it? Give it a rating and let the author know!</p>
<form action='?p=review&id=$idget' method='post'  target='_self'> 
 
 <label> Your rating is on a scale of 1-10 </label>
 <select name='rat'>
    <option> 1 </option>
    <option> 2 </option>
    <option> 3 </option>
    <option> 4 </option>
    <option> 5 </option>
    <option> 6 </option>
    <option> 7  </option>
    <option> 8 </option>
    <option> 9 </option>
    <option> 10 </option>
 </select>
 <label> Commets: </label>
 
 <textarea name='commet' cols='70' rows='9'></textarea>
 <input name='story' type='hidden' value='$idget' /> <br />
 <input type='submit' value = 'Post' name='submit' />
</form>

   ";
}
else 
{
   echo "<div id='message'> Sign in to post a review! <>";
}

?>



Here are the specifics if you want it.

Here is the response part of the code:
Code: [Select]
<?php
if(isset($_POST['submit']))
{
   $com_form = mysql_real_escape_string(bb($_POST['commet']));
   $rat_form = $_POST['rat'];
   $story_form =  $idget;
   $user = $_SESSION['user'];
   $date = date("Y-m-d");
   $query1 = "
   INSERT INTO story_commets(star, story, user, date_added, commet)
   VALUES($rat_form, '$story_form', '$user', '$date', '$com_form')
   ";
   mysql_query($query1) or die(mysql_error());


      
      
   //}
}
?>
Here is the form part of my code:
Code: [Select]
<?php
if (isset($_SESSION['user']))
{
   echo"
   <p> Did you like this story? Did you hate it? Give it a rating and let the author know!</p>
<form action='?p=review&id=$idget' method='post'  target='_self'> 
 
 <label> Your rating is on a scale of 1-10 </label>
 <select name='rat'>
    <option> 1 </option>
    <option> 2 </option>
    <option> 3 </option>
    <option> 4 </option>
    <option> 5 </option>
    <option> 6 </option>
    <option> 7  </option>
    <option> 8 </option>
    <option> 9 </option>
    <option> 10 </option>
 </select>
 <label> Commets: </label>
 
 <textarea name='commet' cols='70' rows='9'></textarea>
 <input name='story' type='hidden' value='$idget' /> <br />
 <input type='submit' value = 'Post' name='submit' />
</form>

   ";
}
else 
{
   echo "<div id='message'> Sign in to post a review! <>";
}
?>
Its probably something really mundane. HelP!

I AM WORKING ON A PROJECT , I NEED YOUR HELP.  I WANT TO USE EXISTING SRC OF IFRAME + RETRIVED VALUE FROM DATABASE INTO IFRAME

This is my data.php to retrive values from database into iframe without refresh web page.

<?php
	$conn = new mysqli('localhost', 'root', '', 'x');
if ($conn->connect_error) {
    die("Connection error: " . $conn->connect_error);
}
$result = $conn->query("SELECT number1 FROM users");
if ($result->num_rows > 0) {
    while ($row = $result->fetch_assoc()) {
        echo $row['number1'] . '<br>';
    }
}
?>

FOLLOWING IS INDEX FILE

<?php include('data.php') ?>
<html>
<head>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
	</head>
<body>
    <div id="show"></div>
    <script type="text/javascript" src="jquery-3.1.1.min.js"></script>
    <script type="text/javascript">
        $(document).ready(function() {
            setInterval(function () {
                $('#show').load('data.php')
            }, 1000);
        });
    </script>
	    <iframe id="w3" src="DATABASE RETRIVED VALUE" height="80px" width="300px" frameborder="0" style="border: 0; width:300px; height:80px; background-color: #FFF;"></iframe>
    </body>
</html>

 

INDEX FILE CODES CAN SUCCESSFULLY RETRIVE VALUES FROM DATABASE BUT, I WANT TO STORE IT IN IFRAME SRC .

VAR= URLS = 'HTTP://WWW.GOOGLE.COM'

IFRAME SRC WILL BE VAR URLS + RETRIEVED VALUE FROM DATABASE

 

 

 

Hi, after following lots of advice and changing to MySqli I am running into a few probs. This is me just probably missing something stupid, I know what I want, but can't figure out what query I should use and where I should place it. All the queries I have tried have failed.   I just need a query that gets the $current_stored_password from the password field on the database, to confirm the last check

elseif 
	($current_password !== $current_stored_password) {
	include 'includes/overall/header.php';
	echo $current_password . ' AND ' . $_POST['current_password'] . ' Password and password again do not match';
	include 'includes/overall/header.php';

}

Here is the whole script.

<?php
session_start();
error_reporting(0);
//ini_set('display_errors', '1');

require( 'database.php' );

$username = $_SESSION['loggedinuser'];
$current_stored_password = $_SESSION['password'];
$current_password = $_POST['current_password'];
$password = mysqli_real_escape_string($con, md5( $_POST['password']));
$password_again = mysqli_real_escape_string($con, md5( $_POST['password_again']));


// Run checks

if	(isset($_POST['current_password'], $_POST['password'], $_POST['password_again'])) {
	
if( strlen( $_POST['current_password'] ) < 8 )
    {
        include('includes/overall/header.php');
        echo "Password Must Be 8 or More Characters.";
        include('includes/overall/footer.php');
}
elseif( strlen( $_POST['password'] ) < 8 )
    {
        include('includes/overall/header.php');
        echo "Password Must Be 8 or More Characters.";
        include('includes/overall/footer.php');
    }
elseif 
		( strlen( $_POST['password_again'] ) < 8 )
    {
        include('includes/overall/header.php');
        echo "Password Must Be 8 or More Characters.";
        include('includes/overall/footer.php');
    }
elseif 
	($password !== $password_again) {
	include 'includes/overall/header.php';
	echo ' Password and password again do not match';
	include 'includes/overall/header.php';
}
elseif 
	($current_password !== $current_stored_password) {
	include 'includes/overall/header.php';
	echo $current_password . ' AND ' . $_POST['current_password'] . ' Password and password again do not match';
	include 'includes/overall/header.php';

} else {

// Define a query to run 
$query = "UPDATE `user` SET `password` = '$password' WHERE `username` = '$username'"; 

// Query the database 
$result = mysqli_query($con,$query); 

// Check if the query failed 
if( !$result ) 
{ 
   die('There was a problem executing the query ('.$query.'):<br>('.mysqli_errno($con).') '.mysqli_error($con)); 
} 

else {

include 'includes/overall/header.php';
	echo 'Password has been changed';
include 'includes/overall/footer.php';
}    
}
}

// Close the connection 
mysqli_close($con); 
?> 

At the moment the message displayed when the form is submitted is

	echo $current_password . ' AND ' . $_POST['current_password'] . ' Password and password again do not match';
 

How do I retrieve the password from the database to compare against the current password entered by the user? Any help is much appreciated.   PS. Yes I know I have repeated code and that md5 is not secure, but I am just building onto a template I got and will be making changes to shorten the code and secure the password soon    

I am not sure if the title is correct; I tried my best. I'm a PHP/MySQL beginner and I really need some help. I have a small script that I am using for sending SMS. I recently added a phonebook. The problem with the phonebook right now is that it's available to all users, i.e. they can all update and delete all rows. What I would like to do is make it so that each user can update and delete only their own contacts. I have a table call contacts. Inside that table there is first name, last name, company and phonenumber. How can I accomplish this with PHP & MySQL?

CREATE TABLE IF NOT EXISTS `contacts` (
`contact_id` int(10) NOT NULL AUTO_INCREMENT,
`firstname` varchar(255) NOT NULL,
`lastname` varchar(255) NOT NULL,
`company` varchar(255) NOT NULL,
`cell_no` text NOT NULL,
PRIMARY KEY (`contact_id`)
) ENGINE=InnoDB  DEFAULT CHARSET=latin1 AUTO_INCREMENT=8 ;

CREATE TABLE IF NOT EXISTS `users` (
`user_id` int(11) NOT NULL AUTO_INCREMENT,
`users_name` varchar(30) NOT NULL,
`uname` varchar(30) NOT NULL,
`u_pass` varchar(60) NOT NULL,
`utype` varchar(30) NOT NULL,
`timezone` varchar(30) NOT NULL,
`uapi_user` varchar(30) NOT NULL,
`uapi_pass` varchar(60) NOT NULL,
PRIMARY KEY (`user_id`)
) ENGINE=MyISAM  DEFAULT CHARSET=latin1 AUTO_INCREMENT=20 ;

<?php
if (isset($_POST['submit'])){
    //form has been submitted1
    $firstname  = trim($_POST['firstname']);
    $lastname   = trim($_POST['lastname']);
    $company    = trim($_POST['company']);
    $cellno = trim($_POST['cell_no']);

    if($firstname == ''){
        echo '<div class="alert alert-danger">First Name is not Valid!</div>';
        exit;
    }elseif($lastname == ''){   
        echo '<div class="alert alert-danger">Last Name is not Valid!</div>';
        exit;
    }elseif($company == ''){    
        echo '<div class="alert alert-danger">Company is not Valid!</div>';
        exit;
    }elseif($cellno == ''){ 
        echo '<div class="alert alert-danger">Cellphone Number is not Valid!</div>';
        exit;

    }else{

        $query = "Select cell_no from contacts where cell_no = '".$cellno."' ";
        $result = mysql_query($query);
        if (!mysql_num_rows($result)) {

        $sql = "INSERT INTO contacts(firstname, lastname, company, cell_no)
                            values('{$firstname}','{$lastname}', '{$company}', '{$cellno}')";
        $result = mysql_query($sql);
        confirm_query($result);

        //echo '<div class="alert alert-success">Successfully added.</div>';
        //exit;
        ?>
                    <script type="text/javascript">
            window.location = "contact_list.php";
        </script>
    <?php
    }
    else{

        echo '<div class="alert alert-danger">Username. already exist!.</div>';
        echo '<p><a href="new_contact.php" class="btn btn-success"> Back </a></p>';
        exit;

    }}

}else{
    $firstname  = "";
    $lastname   = "";
    $company    = "";
    $cellno = "";
}

?>

I have two pages - add_product.php and show.php

here is the code for add_product.php

Code: [Select]
<?php

ini_set('display_errors',1);
error_reporting(-1);

require_once ('./includes/config.inc.php');

require_once (MYSQL);

$add_cat_errors = array();

if ($_SERVER['REQUEST_METHOD'] == 'POST')
{
// Check for a name:
if (empty($_POST['product'])) {
$add_cat_errors['product'] = 'Please enter the name!';
}

// Check for a description:
if (empty($_POST['prod_descr'])) {
$add_cat_errors['prod_descr'] = 'Please enter the description!';
}

// Check for a category:
if (!isset($_POST['cat']) || !filter_var($_POST['cat'], FILTER_VALIDATE_INT, array('min_range' => 1))) {
$add_cat_errors['cat'] = 'Please select a category!';
}

// Check for a price:
if (empty($_POST['price']) || !filter_var($_POST['price'], FILTER_VALIDATE_FLOAT) || ($_POST['price'] <= 0)) {
$add_cat_errors['price'] = 'Please enter a valid price!';
}

// Check for a category:
if (!isset($_POST['directory']) || !filter_var($_POST['directory'], FILTER_VALIDATE_INT, array('min_range' => 1))) {
$add_cat_errors['directory'] = 'Please select a directory!';
}

// Check for a stock:
if (empty($_POST['stock']) || !filter_var($_POST['stock'], FILTER_VALIDATE_INT, array('min_range' => 1))) {
$add_cat_errors['stock'] = 'Please enter the quantity in stock!';
}

if (empty($add_cat_errors))
{
$query = "INSERT INTO product (product, prod_descr, catID, price, dirID, stock) VALUES (?, ?, ?, ?, ?, ?)";
// Prepare the statement:
$stmt = mysqli_prepare($dbc, $query);
// For debugging purposes:
// if (!$stmt) echo mysqli_stmt_error($stmt);

// Bind the variables:
mysqli_stmt_bind_param($stmt, 'sssssi', $name, $desc, $_POST['cat'], $_POST['price'], $_POST['directory'], $_POST['stock']);

// Make the extra variable associations:
$name = strip_tags($_POST['product']);
$desc = strip_tags($_POST['prod_descr']);
// Execute the query:
mysqli_stmt_execute($stmt);

if (mysqli_stmt_affected_rows($stmt) == 1) { // If it ran OK.

// Print a message:
echo '<h4>The product has been added!</h4>';

// Clear $_POST:
$_POST = array();

// Clear $_FILES:
$_FILES = array();


} else { // If it did not run OK.
trigger_error('The product could not be added due to a system error. We apologize for any inconvenience.');
}

} // End of $errors IF.

} else { // Clear out the session on a GET request:
} // End of the submission IF.

require_once ('./includes/form_functions.inc.php');
?>

<form enctype="multipart/form-data" action="add_image.php?prodID={$row['prodID']}" method="post" accept-charset="utf-8">

<input type="hidden" name="MAX_FILE_SIZE" value="524288" />

Product<br /><?php create_form_input('product', 'text', $add_cat_errors); ?>
           
            Description<br /><?php create_form_input('prod_descr', 'textarea', $add_cat_errors); ?>
           
Category<br /><select name="cat"<?php if (array_key_exists('cat', $add_cat_errors)); ?>>
<option>Select One</option>
<?php // Retrieve all the categories and add to the pull-down menu:
$q = 'SELECT catID, cat FROM category ORDER BY cat ASC';
$r = mysqli_query ($dbc, $q);
while ($row = mysqli_fetch_array ($r, MYSQLI_NUM)) {
echo "<option value=\"$row[0]\"";
// Check for stickyness:
if (isset($_POST['cat']) && ($_POST['cat'] == $row[0]) ) echo ' selected="selected"';
echo ">$row[1]</option>\n";
}
?>
</select><?php if (array_key_exists('cat', $add_cat_errors)) echo $add_cat_errors['cat']; ?>
           
            Price<br /><?php create_form_input('price', 'text', $add_cat_errors); ?>
           
            Directory<br /><select name="directory"<?php if (array_key_exists('directory', $add_cat_errors)); ?>>
<option>Select One</option>
<?php // Retrieve all the categories and add to the pull-down menu:
$q = 'SELECT dirID, directory FROM directory ORDER BY directory ASC';
$r = mysqli_query ($dbc, $q);
while ($row = mysqli_fetch_array ($r, MYSQLI_NUM)) {
echo "<option value=\"$row[0]\"";
// Check for stickyness:
if (isset($_POST['directory']) && ($_POST['directory'] == $row[0]) ) echo ' selected="selected"';
echo ">$row[1]</option>\n";
}
?>
</select><?php if (array_key_exists('directory', $add_cat_errors)) echo $add_cat_errors['directory']; ?>
</select>

          <br />

Stock<br /><?php create_form_input('stock', 'text', $add_cat_errors); ?>


<input type="submit" value="Add This Product" class="button" />


</fieldset>

</form>

and here is the code for show.php

Code: [Select]
<?php

ini_set('display_errors',1);
error_reporting(-1);

require_once ('./includes/config.inc.php');

require_once (MYSQL);

$add_cat_errors = array();

if($id = isset($_GET['prodID']))
{
$q = "SELECT `prodID`, `product`, `prod_descr`, `catID`, `dirID`, `price`, `stock` FROM product WHERE `prodID`='{$_GET['prodID']}'";
$r = mysqli_query($dbc, $q);
while($row = mysqli_fetch_array($r))
{
echo $row['product'];
echo "<br />";
echo $row['prod_descr'];
echo "<br />";
echo $row['catID'];
echo "<br />";
echo $row ['dirID'];
echo "<br />";
echo $row['price'];
echo "<br />";
echo $row['stock'];
}
}


What I want is to try and retrieve the id of the last record inserted in add_product and pass it into show.php, but I get this error message.

Quote

An error occurred in script 'C:\Users\David Morgan\Desktop\WEBSITES\hairz_&_graces\site\admin\add_image.php' on line 16:
mysqli_fetch_array() expects parameter 1 to be mysqli_result, boolean given

I am struggling to find out where I am going wrong at the moment, if anyone could please help me that would be really appreciated.