getting ID of user currently logged in

Hello everone,

I am buidling a small job application website, and i'm using a the basis of a login system taken from a Nettuts tutorial.
The logging in works fine, but I am having trouble getting the details for the currently logged in user, for example if a user enters their personal details, i can process the data into the database but it's not linked to which user!
I need a way to identify the user currently logged in, so i can update my insert statements to something like ...
'UPDATE cv where userID = $userID'. any help much appreciated, thx in advance

Aaron

Here's the code i'm using to login a user:

PHP Code:

---

require_once 'includes/constants.php';

class Mysql {
    private $conn;
    
    function __construct() {
        $this->conn = new mysqli(DB_SERVER, DB_USER, DB_PASSWORD, DB_NAME) or
                      die('There was a problem connecting to the database.');
    }
    
    function verify_Username_and_Pass($un, $pwd) {
                
        $query = "SELECT *
                FROM users
                WHERE username = ? AND password = ?
                LIMIT 1";
                
        if($stmt = $this->conn->prepare($query)) {
            $stmt->bind_param('ss', $un, $pwd);
            $stmt->execute();
                        
            if($stmt->fetch()) {
                $stmt->close();
                return true;
    
            }
        }
        
    }
} 


---

Let me know if you need any further info.

Thx in advance,

Aaron

What do you do to remember if the user has logged in? A session variable? Just add another session variable that contains the username.

Quote:

---

Originally Posted by guido2004

What do you do to remember if the user has logged in? A session variable? Just add another session variable that contains the username.

---

Yes it is, here's the code:

PHP Code:

---

require 'Mysql.php';

class Membership {
    
    function validate_user($un, $pwd) {
        $mysql = New Mysql();
        $ensure_credentials = $mysql->verify_Username_and_Pass($un, md5($pwd));
        
        // if above = true
        if($ensure_credentials) {
            $_SESSION['status'] = 'authorized';
        
            header("location: ../myIWC.php");
        } else return "Please enter a correct username and password";
        
    } 
    
    function log_User_Out() {
        if(isset($_SESSION['status'])) {
            unset($_SESSION['status']);
            
            if(isset($_COOKIE[session_name()])) 
                setcookie(session_name(), '', time() - 1000);
                session_destroy();
        }
    }
    
    function confirm_Member() {
        session_start();
        if($_SESSION['status'] !='authorized') header("location: ../login.php");
    }
    
} 


---

How would i add another session variable for the user id? something like this i would guess? (near line 11)?

PHP Code:

---

// if above = true
        if($ensure_credentials) {
            $_SESSION['status'] = 'authorized';
                $_SESSION['username'] = '$un';
            header("location: ../myIWC.php");
        } 


---

thx for your speedy reply :)

Aaron

$_SESSION['username'] = $un;

Exactly :)
No need for the quotes around $un, though

Thank you a whole big bunch so for your advice n guidance, very helpful :)

Aaron

jus a quick note... i suppose i can now identify users by

$currentUser = $_SESSION['username'];

....update cv where username = $currentUser.

Could i alter my code to grab the user ID field from the database?

Thx

Aaron :)

I don't know how your class works, but this query:

Code MySQL:

---

        $query = "SELECT *
                FROM users
                WHERE username = ? AND password = ?
                LIMIT 1";

---

Looks good (I don't know what the ? mark does though),

Anyways, you should be able to get the id from this one query.

PHP Code:

---

$_SESSION['username'] = $un;
$_SESSION['userID'] = $however_you_fetched_the_username['id']; // just do it for the "id" row 


---

Thx for your input, will test it in a moment, the ? are used to bind parameters as my db queries are done using prepared statements.