用php登陆mysql数据库,mysql和php - 基于用户登录从数据库检索数据

before I go ahead and attempt to create a website, I wanted to know if pulling a users content from a database depending on which user is logged in can be determined by a $_SESSION variable. So for example if I want all the messages for user 'example':

$_SESSION['username'] = $_POST['username'] // set when the user logs in

$username = $_SESSION['username']

$data = mysql_query("Select * from messagesTable where username = '$username'")

while($row = mysql_fetch_array($data)) {

echo $row['message']

}

I wanted to know if this would be the right way to do something like this and also if its safe to return (personal) data based on a session variable.

I haven't got that much experience in either of these languages but I like to learn with experience, please tell me if it's not clear. Thanks.

解决方案

It is safe to return user data based on a $_SESSION variable if you are certain of its validity because you set it yourself in code. It is not safe to return data based on a session variable that you get from $_POST.

You initially set

$_SESSION['username'] = $_POST['username'];

So unless you have verified with a password or otherwise that this user is who he claims to be, you should not use $_POST['username'] to return other information. If your login process (which we cannot see above) already verifies that $_POST['username'] is valid, you can use it as a source to retrieve additional information.

You will need also to filter against SQL injection:

$_SESSION['username'] = mysql_real_escape_string($_POST['username']);