Use session name in MySQL statement - php

Question

I'm having problem with my php code.
I need to query db using in WHERE session name from php page.
Below code:
<?php session_start();
try {
//$con= new PDO('mysql:host=localhost;dbname=wydania_tonery', "sa", "sql");
$zmien_kodowanie = $dbo->query("SET names 'utf8'");
$sesja = $_SESSION['username'];
$query = "SELECT
mdl_user.firstname AS 'Imie',
mdl_user.lastname AS 'Nazwisko',
mdl_user.department AS 'Akronim',
reg.data AS 'Region',
sta.data AS 'Stanowisko',
mdl_user.aim AS 'Stan',
NULLIF('Uwagi', 0) AS 'Uwagi'
FROM
mdl_user
LEFT JOIN
mdl_user_info_data AS reg ON reg.userid=mdl_user.id AND reg.fieldid='2'
LEFT JOIN
mdl_user_info_data AS sta ON sta.userid=mdl_user.id AND sta.fieldid='4'
WHERE
mdl_user.email LIKE 'kierownik.%' AND mdl_user.deleted='0' AND mdl_user_info_data.fieldid = ".$_SESSION['username']." /*AND mdl_user.department='BBT'*/
ORDER BY
mdl_user.department ASC";
//first pass just gets the column name
echo "<table> \n";
$result = $dbo->query($query);
//return only the first row (we only need field names)
$row = $result->fetch(PDO::FETCH_ASSOC);
print " <tr> \n";
foreach ($row as $field => $value){
print " <th>$field</th> \n";
} // end foreach
print " </tr> \n";
//second query gets the data
$data = $dbo->query($query);
$data->setFetchMode(PDO::FETCH_ASSOC);
foreach($data as $row){
print " <tr> \n";
foreach ($row as $name=>$value){
print " <td>$value</td> \n";
} // end field loop
print " </tr> \n";
} // end record loop
print "</table> \n";
} catch(PDOException $e) {
echo 'ERROR: ' . $e->getMessage();
} // end try
?>
When I use standard way (".$variable.") to pass php variable I got error below:
Fatal error: Call to a member function fetch() on boolean in
Path/to/my/page on line 35
If anyone would like to help me solve my problem I'd be glad to thank him

Answer 1

Try
<?php session_start();
try {
//$con= new PDO('mysql:host=localhost;dbname=wydania_tonery', "sa", "sql");
$zmien_kodowanie = $dbo->query("SET names 'utf8'");
$sesja = $_SESSION['username'];
$query = "SELECT
mdl_user.firstname AS 'Imie',
mdl_user.lastname AS 'Nazwisko',
mdl_user.department AS 'Akronim',
reg.data AS 'Region',
sta.data AS 'Stanowisko',
mdl_user.aim AS 'Stan',
NULLIF('Uwagi', 0) AS 'Uwagi'
FROM
mdl_user
LEFT JOIN
mdl_user_info_data AS reg ON reg.userid=mdl_user.id AND reg.fieldid='2'
LEFT JOIN
mdl_user_info_data AS sta ON sta.userid=mdl_user.id AND sta.fieldid='4'
WHERE
mdl_user.email LIKE 'kierownik.%' AND mdl_user.deleted='0' AND mdl_user_info_data.fieldid = ? /*AND mdl_user.department='BBT'*/
ORDER BY
mdl_user.department ASC";
//first pass just gets the column name
echo "<table> \n";
$stmt = $dbo->prepare($query);
$stmt->bind_param("s", $_SESSION['username']);
$result = $stmt->execute();

Answer 2

Instead of using direct substitution values, you could use below methods to avoid sql injection.
You basically have two options to achieve this:
Using PDO:
$stmt = $pdo->prepare('SELECT * FROM employees WHERE name = :name');
$stmt->execute(array('name' => $name));
foreach ($stmt as $row) {
// do something with $row
}
Please refer How can I prevent SQL-injection in PHP?