PHP - Check if user is an admin or not [duplicate] - php

This question already has answers here:
Reference - What does this error mean in PHP?
(38 answers)
How to include php file in a php file
(1 answer)
What to do with mysqli problems? Errors like mysqli_fetch_array(): Argument #1 must be of type mysqli_result and such
(1 answer)
Closed 5 years ago.
So i have a page where there is a button when clicked it takes u to an admin page.
if u click it first takes u to a admincheck code before bringing u to the adminpage. In that admincheck page it should let admins go through and normal users redirected back. It doesnt work i dont know why
here is the admincheck code:
<?php
include "dbconnection.php";
include "login.php;"
$query = "SELECT * FROM gebruikers WHERE gebruikerID = $userid";
$result = mysqli_query($conn, $query);
$count = $conn->affected_rows;
if($row['admin']=='Ja'){
header("location: contactregister.php");
}
else{
$message = "You shall not pass!";
echo "<script type='text/javascript'>alert('$message');</script>";
header("location: home.php");
}
?>
Did i do anything wrong in that code??

Related

Verification of sign up [duplicate]

This question already has answers here:
Why shouldn't I use mysql_* functions in PHP?
(14 answers)
How to check if a row exists in MySQL? (i.e. check if username or email exists in MySQL)
(4 answers)
Closed 2 years ago.
I wrote a new form of signup. But it's done vice versa what I need. I show code exists if it's in DB and bypass sing-up if there is any. But I need that it shows: "Wrong code" if "sec_code" not found in my DB (created already a list of these codes) and bypass if it exists in DB. Thx. Stuck on this.
if($_GET['action'] == "save")
{
$sec_code = htmlspecialchars($_POST['sec_code'], ENT_QUOTES, '');
$yes = intval($_POST['yes']);
if(!$sec_code) {
$error = "<p class=\"er\"></p>";
}
elseif(mysql_num_rows(mysql_query("SELECT skey FROM users WHERE sec_code = '".$sec_code."'"))) {
$error = "<p class=\"er\">Security code exist!</p>";

Form doesn't send properly [duplicate]

This question already has answers here:
How to fix "Headers already sent" error in PHP
(11 answers)
Closed 4 years ago.
I've been trying to make a form in Wordpress to post data to the database and check if the data matches and if so then it proceeds to the next form but I can't seem to get it to work properly, been testing having the form placed in the themes folder to allow straighter testing, the php looks like this:
<?php
if(isset($_POST['submit'])) {
global $wpdb;
$ordernumber = $_POST['ordernmbr'];
$orderfirstname = $_POST['firstname'];
$orderpostnumber = $_POST['postnmbr'];
// Sanitizing
$ordernumber = stripslashes_deep($ordernumber);
$orderfirstname = stripslashes_deep($orderfirstname);
$orderpostnumber = stripslashes_deep($orderpostnumber);
$sql = "SELECT * FROM wp_postmeta WHERE 'post_id' = %d";
$sql = $wpdb->prepare($sql, array($ordernumber));
$res = $wpdb->get_results($sql);
if ($res > 0) {
wp_redirect(admin_url('http://localhost/wordpress/index.php/shop/'));
die();
} else {
$error = "Not like this";
echo $error;
}
print_r($res);
}
?>
<?php
get_footer();
?>
}
The problem is that when I try to post data it gives me an error saying
Warning: Cannot modify header information - headers already sent by (output started at /Applications/XAMPP/xamppfiles/htdocs/wordpress/wp-includes/class.wp-styles.php:225) in /Applications/XAMPP/xamppfiles/htdocs/wordpress/wp-includes/pluggable.php on line 1219
how do I go on about fixing this?
You can't redirect the browser after the content has already begun being served.
That piece of code needs to be included before the theme starts loading, so it needs to be in a plugin.
When setting up the plugin, be sure to give it a high priority, and choose the right filter/action to have it load early (before any content is rendered): WP Action Reference

Server-side email already exist validation in PHP [duplicate]

This question already has answers here:
How to check if a row exists in MySQL? (i.e. check if username or email exists in MySQL)
(4 answers)
Reference - What does this error mean in PHP?
(38 answers)
What to do with mysqli problems? Errors like mysqli_fetch_array(): Argument #1 must be of type mysqli_result and such
(1 answer)
Closed 4 years ago.
I have a form and fields are Name, Email, Password. Client-side validation is working perfectly. I am working on server-side validation.
I am getting the issue on else part. For testing, I added echo $email and I am getting the email id. Now that email id will check in the database is exists or not. If exist the display the error if not existing the display the not exist.
if(condition){}
elseif(condition){}
elseif(condition){}
elseif(condition){}
else{
echo $email; // here I am able to display the email id
$sql_check_email="SELECT email FROM register WHERE email =?";
$stmt = $conn->prepare($sql_check_email);
$stmt->bind_param("s", $email);
$stmt->execute();
$stmt->bind_result($email);
$rows = $stmt->fetch();
$total_rows = count($rows);
if( $total_rows > 0 ){
$_SESSION['email_error']= 'This email is alredy register with us';
header('location:register');
}else{
echo $email;// why my email id not displaying here?
echo $name;
echo $password;
echo $date_of_added;
echo"Not exist";
}
Your issue is:
$stmt->bind_result($email);
That line replaces variable with query result.
Just use another variable for results.
You also use fetch result wrong, it returns just true/false/null value of fetch state. Use bind_result binded variable to get your results.

ForgotPassword PHP and Mysql [duplicate]

This question already has answers here:
Reference - What does this error mean in PHP?
(38 answers)
What to do with mysqli problems? Errors like mysqli_fetch_array(): Argument #1 must be of type mysqli_result and such
(1 answer)
Closed 5 years ago.
I am writing a login form with PHP and Mysql.
I did everything its just the forgot password that is not working.
It sends me email confirmation but it does not update the password in the database.
First is the forgot page, then sends an email and redirect me to the confirm_pass.html page where is the form for the two passwords and on this page executes the confirm_pass.php where is doing everything, except updating the password in the database.
Please help.
<?php
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
// Make sure the two passwords match
if ( $_POST['newpassword'] == $_POST['confirmpass'] ) {
$new_password = password_hash($_POST['newpassword'], PASSWORD_BCRYPT);
$email = $mysqli->escape_string($_POST['email']);
$confirm_code = md5(rand().$password);
$result = "UPDATE `mv_db`.`users` SET `password`='$new_password', `confirm`='$confirm_code' WHERE `email`='$email'";
if ( $mysqli->query($result) ) {
header("location: login.html");
}
}
else {
$_SESSION['message'] = " The two passwords you entered don't match, try again!";
header("location: error.php");
}
}
?>
Your $_POST['email'] is not defined, because there is no "email" field in your HTML form.
So nothing is updated in database, because there is no matching record.

Updating data Php pdo [duplicate]

This question already has answers here:
Why does this PDO statement silently fail?
(2 answers)
Closed 6 years ago.
Im trying to update my data using php but it doesnt work, any ideas?
This is the code, this isnt the full code (its not done) but even the username cant be updated.
<?php
session_start();
include "dbconfig.php";
require "check.php";
if(!empty($_POST['user_name']) || !empty($_POST['user_email'])){
$user_name = trim($_POST['user_name']);
$user_email = trim($_POST['user_email']);
$count=$db_con->prepare("SELECT * FROM users WHERE user_id=:userid");
$count->bindParam(":userid",$_SESSION['user_session'],PDO::PARAM_STR,15);
$count->execute();
$row = $count->fetch(PDO::FETCH_OBJ);
$sql=$db_con->prepare("update users set user_name=:username where user_id='$row->user_id'");
$sql->bindParam(':username',$user_name,PDO::PARAM_STR, 32);
if($sql->execute()){
echo "Successfully updated Profile";
}
else{
print_r($sql->errorInfo());
}
else {
echo "No data inserted!"
}
include "home.php";
?>
I guess a syntax error in this Line
$sql=$db_con->prepare("update users set user_name=:username where user_id='$row->user_id'");
Corrected
$sql=$db_con->prepare("update users set user_name=:username where user_id="$row->user_id);

Categories