Displaying users profile information - php

Question

I am having problems with displaying out users profile information when clicking on their profile. the data shown is my own when logged in so it isn't switching. I cannot find the issue and wondering where I maybe going wrong?
So the information should be showing out on profile.php
if (isset($_GET['username']) === true && empty ($_GET['username']) === false) {
$username = $_GET['username'];
if (user_exists($username) === true) {
$user_id = user_id_from_username($username);
$profile_data = user_data($user_id, 'first_name', 'last_name', 'email');
?>
<h1><?php echo $profile_data['first_name']; ?> profile</h1>
<p><?php echo $profile_data['email'] ?></p>
<?php
} else {
echo 'Sorry, that user does not exist';
}
} else {
header('Location: index.php');
exit();
}
It shows my information and not the user I am trying to view. If I type in a bogus username on the URL it does error out and say they do not exist.
Here is my script to pick the data out of the database:
if (logged_in() === true) {
$session_user_id = $_SESSION ['user_id'];
$user_data = user_data($session_user_id, 'user_id', 'username', 'password', 'first_name', 'last_name', 'email', 'type', 'profile');
if(user_active($user_data['username']) === false) {
session_destroy();
header('Location: index.php');
exit();
}
}
$errors = array();
Im using a .htaccess file o initliase the vanity URL
RewriteEngine On
RewriteCon %{REQUEST_FILENAME} !-f
RewriteCon %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /profile.php?username=$1
so my URL would look like this...
http://mywebsite.com/myname
here is the function for user_data
function user_data($user_id) {
$data = array();
$user_id = (int)$unser_id;
$func_num_args = func_num_args();
$func_get_args = func_get_args();
if ($func_num_args > 1){
unset($func_get_args[0]);
$fields = '`' . implode('`, `', $func_get_args) . '`';
$data = mysql_fetch_assoc(mysql_query("SELECT $fields FROM `users` WHERE 'user_id' = $user_id"));
return $data;
}
}
And it does work by changing myname but not switching the user data on the profile page to other users data.
As requested: user_exists() function
function user_exists($username) {
$username = sanitize($username);
$query = mysql_query("SELECT COUNT(`user_id`) FROM `users` WHERE `username` = '$username'");
return (mysql_result($query, 0) == 1) ? true : false;
}

Answer 1

Try this
function user_data($user_id, $fields = '*') {
// type cast to int
$user_id = (int) $user_id;
// if an array is passed, we implode the array to get fields,
// otherwise we return all rows
if (is_array($fields))
{
$fields = implode('`, `', $fields) . '`';
}
//build query, with LIMIT 1 , I assume username is unique
$qry = "SELECT {$fields} FROM `users` WHERE 'user_id' = {$user_id} LIMIT 1";
$sql = mysql_query($qry);
$result = mysql_fetch_assoc($sql);
// if we have a result, return it, otherwise return false
return (mysql_num_rows($sql) == 1) ? $result : false ;
}
to be used:
$profile_data = user_data($user_id, array('user_id', 'username', 'password', 'first_name', 'last_name', 'email', 'type', 'profile'));
or
$fields = array(
'user_id',
'username',
'password',
'first_name',
'last_name',
'email',
'type',
'profile'
);
$profile_data = user_data($user_id, $fields);