WHERE statement not working in SQL that should update data [closed] - php

Question

Closed. This question needs debugging details. It is not currently accepting answers.
Edit the question to include desired behavior, a specific problem or error, and the shortest code necessary to reproduce the problem. This will help others answer the question.
Closed 2 years ago.
Improve this question
This time i am trying to make a last seen on user profiles. I've added a column called lastseen in my phpmyadmin with type "DATETIME". When a user logs out, the lastseen should update to the date and hour it currently is. So i made an SQL in my logout script that updates this value. When i tested it, it was not working as always.. Tried many things but none are helping. I figured out that without my WHERE statement the date just updates as it should, but sadly for all users. So the WHERE statement is required in the SQL. And i added it back after testing without it but it's not working again, wich makes me sure its something with WHERE but i really don't see what.
This is my logout script:
<?php
session_start();
session_unset(); // Well.. One of these two will definitely work!
session_destroy();
// Updating
include('C:\xampp2\htdocs\settings\sh_config.php');
include('./static/index/scripts/session_start.php');
$conn = mysqli_connect($database['host'], $database['user'], $database['password'], $database['db'], $database['port']);
$last_timestamp = date("Y-m-d H:i:s");
$last_user = $_SESSION['username'];
$lastseen_query = mysqli_query($conn, "UPDATE users SET lastseen='$last_timestamp' WHERE username = '$last_user'");
header('Location: /');
$conn->close();
?>
The include of "sh_config.php" is private, but i will tell what it does in this script. Well simple answer: i configured the database connection in that file. So everything with $database is configured correctly in that file.
The script of the "session_start.php":
<?php
include('C:\xampp2\htdocs\settings\sh_config.php');
session_start();
// Initializing variables
$username = "";
$email = "";
$errors = array();
// Connect to the database
$db = mysqli_connect($database['host'], $database['user'], $database['password'], $database['db'], $database['port']);
// REGISTER USER
if (isset($_POST['reg_user'])) {
// Receive all input values from the form
$username = mysqli_real_escape_string($db, $_POST['username']);
$email = mysqli_real_escape_string($db, $_POST['email']);
$password_1 = mysqli_real_escape_string($db, $_POST['password_1']);
$password_2 = mysqli_real_escape_string($db, $_POST['password_2']);
$fname = mysqli_real_escape_string($db, $_POST['fname']);
$lname = mysqli_real_escape_string($db, $_POST['lname']);
$sex = mysqli_real_escape_string ($db, $_POST["sex"]);
$bday = mysqli_real_escape_string($db, $_POST['bday']);
// Form validation: ensure that the form is correctly filled ...
// By adding (array_push()) corresponding error unto $errors array
if (empty($username)) { array_push($errors, "Username is required"); }
if (empty($email)) { array_push($errors, "Email is required"); }
if (empty($password_1)) { array_push($errors, "Password is required"); }
if (empty($fname)) { array_push($errors, "Firstname is required"); }
if (empty($lname)) { array_push($errors, "Lastname is required"); }
if (empty($sex)) { array_push($errors, "What is your gender?"); }
if (empty($bday)) { array_push($errors, "When is your cakeday?"); }
if ($password_1 != $password_2) {
array_push($errors, "The two passwords do not match");
}
// First check the database to make sure
// A user does not already exist with the same username and/or email
$user_check_query = "SELECT * FROM users WHERE username='$username' OR email='$email' LIMIT 1";
$result = mysqli_query($db, $user_check_query);
$user = mysqli_fetch_assoc($result);
if ($user) { // If user exists
if ($user['username'] === $username) {
array_push($errors, "Username already exists");
}
if ($user['email'] === $email) {
array_push($errors, "Email already exists");
}
}
// Finally, register user if there are no errors in the form
if (count($errors) == 0) {
$password = md5($password_1); // Encrypt the password before saving in the database
$user_ip = $_SERVER['REMOTE_ADDR']; // Getting the IP of the user
$bio = $config['default-bio']; // Setting default biography
$profileimg = $config['default-profileimg']; // Setting default profile image
$timestamp = date('d.m.Y'); // Defining the current date
$query = "INSERT INTO users (username, bio, profileimg, regdate, email, password, firstname, lastname, gender, birthday, ip)
VALUES('$username', '$bio', '$profileimg', '$timestamp', '$email', '$password', '$fname', '$lname', '$sex', '$bday', '$user_ip')";
mysqli_query($db, $query);
session_regenerate_id();
$_SESSION['username'] = $username;
$_SESSION['loggedin'] = TRUE;
$_SESSION['success'] = "You are now logged in";
// Generate user id
$generate_id_query = "SELECT id FROM users WHERE username='$username' ORDER BY id";
$get_id = $db->query($generate_id_query);
$gen_id = $get_id->fetch_assoc();
if ($gen_id['id'] <= 0) { // Checking if the user id is a valid id (not below or equal to 0), and if not, displaying a critical error
array_push($errors, "Something went wrong whilst signing up, please refer to the helpcenter. (SE100)");
}
if ($get_id->num_rows > 0 && $gen_id['id'] > 0) { // Redirecting the user to his or her profile if it is a valid id
header('location: /content/users/profile?id=' . $gen_id['id'] . '');
}
}
}
// ...
// LOGIN USER
if (isset($_POST['login_user'])) {
$username = mysqli_real_escape_string($db, $_POST['username']);
$password = mysqli_real_escape_string($db, $_POST['password']);
if (empty($username)) {
array_push($errors, "Username or email is required");
}
if (empty($password)) {
array_push($errors, "Password is required");
}
if (count($errors) == 0) {
$password = md5($password);
$query = "SELECT * FROM users WHERE ( username='$username' OR email = '$username' ) AND password='$password'";
$results = mysqli_query($db, $query);
if (mysqli_num_rows($results) == 1) {
session_regenerate_id();
$_SESSION['username'] = $username;
$_SESSION['loggedin'] = TRUE;
$_SESSION['success'] = "You are now logged in";
// Get user id
$get_id_query = "SELECT id FROM users WHERE username='$username' ORDER BY id";
$get_id = $db->query($get_id_query);
$user_id = $get_id->fetch_assoc();
if ($user_id['id'] <= 0) { // Checking if the user id is a valid id (not below or equal to 0), and if not, displaying a critical error
array_push($errors, "Something went wrong whilst logging in, please refer to the helpcenter. (SE100)");
}
if ($get_id->num_rows > 0 && $user_id['id'] > 0) { // Redirecting the user to his or her feed if it is a valid id
header('location: /content/users/profile?id=' . $user_id['id'] . '');
}
}else {
array_push($errors, "Your credentials do not match our records");
}
}
}
?>
Well, as you see, theres alot of info in it. Basically, this manages everything of registering and logging in and redirecting to the unique profile with the user id. I thought this file might come in handy because the id and username are defined in this file. If you look good, you can see that i included this file to my logout script so the defined words should just work, but they don't. Trying to redefine it in the file without the include, doesn't work either. Oh by the way, i use MySQLi.
Help me out please, thanks already.

Answer 1

You have a bug in your code, in that when a user logs in with their email address that address is stored in $_SESSION['username']. In your log out script you assume that that is in fact their username where in reality it might not be. Change your update query to something like this and your problem might be solved:
UPDATE users
SET lastseen='$last_timestamp'
WHERE username = '$last_user'
OR email = '$last_user';
While this might work I would recommend making use of your precious user id. Instead of comparing strings, which are susceptible to various kinds of errors (letters with wrong case, leading/trailing white space, different encoding, etc.), compare your IDs. This not only makes things less error-prone but will also cut down your computation time, especially in the context of database lookups.
$_SESSION['user_id'] = $user_id['id']; // or $gen_id['id'] in the signup code.
$last_user = $_SESSION['user_id'];
$lastseen_query = mysqli_query($conn, "UPDATE users SET lastseen='$last_timestamp' WHERE id = '$last_user'");
To debug issues like this yourself in the future you can utilize a popular, quick-and-dirty way of dumping the contents of a variable: Print/echo the values of $username and $email when you create a user and echo the value of $username that is used in the above script to update the last seen value in the database like this:
$username = mysqli_real_escape_string($db, $_POST['username']);
$email = mysqli_real_escape_string($db, $_POST['email']);
var_dump($username);
var_dump($email);
$last_user = $_SESSION['username'];
var_dump($last_user);
If the dump of $last_user matches $email you know that the above bug applies and is the reason why your script(s) misbehave. You might also find there is some issue with the string values (maybe an unintended mutation at some point) which causes the comparison in your SQL query to fail.