Failing To Display Username - php

Question

I am having a problem trying to display the username on the profile page from the $_GET, the session is created but unable to display the username on the profile page.
<?php include("template/header.php");
include("requires/connection.php"); ?>
<?php
if(isset($_GET['u'])) {
$username = mysqli_real_escape_string($_GET['u']);
if(ctype_alnum($username)) {
// Check user exists
$check = mysqli_query("SELECT username FROM users WHERE username='$username'");
if(mysqli_num_rows($check)===1) {
$get = mysqli_fetch_assoc($check);
$username = $get['username'];
}
else {
echo "<h2>User doesn't exist</h2>";
exit();
}
}
}
?>
<div class="profile-content-container">
<h1>Profile <?php echo "$username"; ?></h1>
<p>Welcome</p>
</div><!-- end of profile-content-container -->
<div class="profileMenu">
<div id="leftsideMenu">
<ul>
<li>Home</li>
<li>My Profile</li>
<li></li>
<li></li>
<li>Logout</li>
</ul><!-- end of menu -->
</div><!-- end of leftsideMenu -->
</div><!-- end of profileMenu -->
<?php include("template/footer.php"); ?>

Answer 1

Both mysqli_real_escape_string() and mysqli_query() functions require that the DB connection be passed as the first parameter; yours doesn't have that.
mysqli_real_escape_string($con, $_GET['u'])
^^^^^ see that?
so...
$username = mysqli_real_escape_string($con, $_GET['u']);
^^^^^ add the db connection variable
and for the query
mysqli_query($con, "SELECT ...
^^^^^ see that?
I used $con here, because there is no indication as to which variable you are using to assign the connection to.
References:
http://php.net/manual/en/mysqli.query.php
http://php.net/manual/en/mysqli.real-escape-string.php
Sidenote: You may want to change this
if(mysqli_num_rows($check)===1)
to
if(mysqli_num_rows($check) >0 )
where I seen in some case that ===1 failed.
Another thing, changing this block of code
$get = mysqli_fetch_assoc($check);
$username = $get['username'];
to, and using a while loop
while($get = mysqli_fetch_assoc($check)){
// or mysqli_fetch_array
$username = $get['username'];
}
Plus, your DB connection should be mysqli_ based and not mysql_ or PDO, which is also unknownst to us.
Those different MySQL APIs do not intermix.
References:
http://php.net/manual/en/function.mysqli-connect.php
http://php.net/manual/en/mysqlinfo.api.choosing.php
Add or die(mysqli_error($con)) to mysqli_query() to check for errors.
Add error reporting to the top of your file(s) which will help find errors.
<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);
// rest of your code
Sidenote: Displaying errors should only be done in staging, and never production.
Your code shows a GET array; without knowing where that is populated from, make sure it's set and not empty.
If using a form, then make sure that a POST method isn't implied.
If your form is using a POST method, then you should be using POST and not GET. Make sure the element has a "name" attribute, IF you're using form.
Also unknownst to us.
Again, if you're using a form with a POST method, or whatever, make sure there is a name attribute for it.
I.e.:
<input type="text" name="u">
Edit:
This part will throw an undefined variable notice:
<h1>Profile <?php echo "$username"; ?></h1>
So, use a conditional statement for it:
<h1>Profile
<?php
if(isset($username) && !empty($username)) {
echo $username;
}
else{
echo "Username is empty or not set somewhere.";
}
?>
</h1>
or use a ternary operator
<h1>Profile <?php echo $username ? $username : ""; ?></h1>
or
<h1>Profile <?php echo $username ? $username : "It is empty"; ?></h1>
or
<h1>Profile <?php echo !empty($_GET['u']) ? $_GET['u'] : ""; ?></h1>
or
<h1>Profile <?php echo !empty($_GET['u']) ? $_GET['u'] : "It is empty."; ?></h1>
As you stated in comments, you are using ?u="username" which should read without quotes ?u=username or as an example ?u=john no quotes and may be case sensitive. So john may not be the same as John with an uppercase "J".