Displaying data connected to the logged in user - php

Question

I'm building a website where users log in and then are redirected to another page. I want to display their usernames and profile pictures in the top bar, but my code doesn't work.
I use the code below, which now that I think of it obviously couldn't work, bacause it will always display the first username and picture in the database. But I don't know how to fix that so that it displays the username and picture of the user who have logged in.
HTML and PHP
<?php
mysql_select_db($database_connection, $connection);
$query_user = "SELECT username, profilepic FROM user";
$user = mysql_query($query_user, $connection) or die(mysql_error());
$row_user = mysql_fetch_assoc($user);
$totalRows_user = mysql_num_rows($user);
?>
<div id="top">
<img src="images/<?php echo $row_user['profilepic']; ?>">
<?php echo $row_user['username']; ?></a>
</div>
EDIT
Login script
<?php
if (isset($_REQUEST['login'])){
$username = mysql_real_escape_string($_POST['username']);
$password = mysql_real_escape_string($_POST['password']);
$query = "SELECT * FROM `username` WHERE username='$username' and password='$password'";
$result = mysql_query($query) or die(mysql_error());
$count = mysql_num_rows($result);
if ($count == 1){
$_SESSION['username'] = $username;
header('Location: content.php');
}else{
echo "Invalid Login Credentials.";
}
}
if (isset($_SESSION['username'])){
$username = $_SESSION['username'];
header('Location: content.php');
}
?>

Answer 1

store the usename in session after login code like this
<?php
session_start();
.......
//your php login code which validates the username and password ...
.......
//then here
$_SESSION['valid_user']=$username;//$username is who is logged in
now in the above use this session value like this
session_start();
$query_user = "SELECT username, profilepic FROM user where username=".$_SESSION['valid_user'];//or
$user = mysql_query($query_user, $connection) or die(mysql_error());
$row_user = mysql_fetch_assoc($user);
$totalRows_user = mysql_num_rows($user);

Answer 2

HTTP is a stateless protocol.
That means (for our discussion) that the server doesn't know that you are the same guy who logged in in the previous transaction he handled. Therefore you need to identify yourself each time.
This is accomplished with sessions. Session identifier is a unique string that identifies a specific client. In every request the client makes the session identifier is included either as a GET, POST or COOKIE variable.
It is unproductive and dangerous to send each and every time the user name and password to the server. What you should do instead is:
Check the username and password that the user sends to your php script. If the credentials are correct execute
session_start();
Then you should store the session identifier (which is a random string) returned from
session_id();
in a database table that has two columns. The first column is for your random string and the second for storing the primary key value of the row from your users table that holds the data of the user that sent you his credentials. An script that would do that is:
$userResult = mysql_query('select id from users where binary userName = \''.
mysql_real_escape_string($_POST['userName']) .'\' and binary passWord= \''.
mysql_real_escape_string($_POST['passWord']) .'\'');
if (mysql_num_rows($userResult))
{
start_session();
$userId = mysql_fetch_row($userResult);
mysql_query('insert into sessions (sessionId, userId) values (\''.
mysql_real_escape_string(session_id()) .'\', \''. (int)$userId[0] .'\')');
}else
{
//handle user supplying bad username or password
}
Each time the user sends a request you should find out who he is:
session_start();
$inputSessionIdentifier = mysql_real_escape_string(session_id());
$result = mysql_query('select * from sessions where sessionId = \''.
$inputSessionIdentifier .'\'');
if (mysql_num_rows($result))
{
// user is already logged in, lets find out his data
$sessionData = mysql_fetch_assoc($result);
$userResult = mysql_query('select * from users where id=\''.
mysql_real_escape_string($sessionData['userId']) .'\'');
$userData = mysql_fetch_assoc($userResult);
echo 'Hello '. $userData['userName'];
}else
{
//user is not logged in, ask for credentials or whatever ...
}
an example definition of the sessions table could be :
create table sessions ( sessionId varchar(255) not null,
userId int(10) unsigned not null,
unique(sessionId));
assuming that your users table has an unsigned integer primary key and is defined along the lines of :
create table users (id int(10) unsigned not null auto_increment primary key,
userName varchar(16) not null,
passWord varchar(100) not null,
unique(userName));
Have in mind that sessions must expire and the relevant table should be purged of inactive sessions. That means that a real life script would be a tad more complex...
IMPORTANT SECURITY ISSUE!
The sample above assumes that you are storing plain text passwords in your database. This is WRONG and a very poor security practice. Passwords should always be stored in an encrypted (hashed) form preferably the one generated by the blowfish cypher.