fields and bind_param / ajax post request - php

Question

I am trying to create a PHP login system. I am at the point where I have logged the user data into session variables, as well as into a user database using mysqli. When a user creates an account they get redirected to a profile page. On this page I am trying to display the user's email, and the user's username. I have no problem displaying the username as I stored it in a session variable. However, I can't seem to figure out how to get the email displayed. I did not store the email in a session variable. I am trying to retrieve it from the user database (not the session database). Here is some code:
showuser.php (profile page):
<?php
session_start();
$host="localhost"; // Host name
$uname="root"; // Mysql username
$password=""; // Mysql password
$db_name=""; // Database name
$tbl_name="users"; // Table name
// Connect to server and select database.
$mysqli = mysqli_connect($host, $uname, $password, $db_name);
$stmt = $mysqli->prepare("SELECT email FROM users WHERE email = ?");
$stmt->bind_param("s", $email);
$stmt->execute();
$stmt->bind_result($em);
$stmt->fetch();
?>
<h2>Username - Email</h2>
<div id="userinfo"><? echo $_SESSION["username"] ?> - <? echo $em ?></div>
<?
$stmt->close();
mysqli_close($mysqli);
?>
storeuser.php
<?php
session_start();
$host="localhost"; // Host name
$uname="root"; // Mysql username
$password=""; // Mysql password
$db_name="itit"; // Database name
$tbl_name="users"; // Table name
// Connect to server and select database.
$mysqli = mysqli_connect($host, $uname, $password, $db_name);
// Get values from form
$username=$_POST['username'];
$pw=$_POST['pw'];
$email=$_POST['email'];
$_SESSION["timeout"] = time();
$_SESSION["username"] = $_POST['username'];
$_SESSION["password"] = $_POST['pw'];
$_SESSION["loggedIn"] = true;
// Insert data into mysql
$sql = "INSERT INTO $tbl_name(username, password, email)VALUES(?,?,?)";
$stmt = $mysqli->prepare($sql);
$stmt->bind_param("sss", $username, $password, $email);
$stmt->execute();
?>
<?php
// close connection
mysqli_close($mysqli);
?>
application.js
$("#signupform").submit(function(e) {
e.preventDefault();
$.post('storeuser.php', $(this).serialize(), function(data){
$("#showuser").load("templates/showuser.php");
$("#userinfo").text(data);
$("#signupform").remove();
});
});
It was pointed out to me in a previous question I had (regarding PDO) - that for the email to get displayed on the profile page, I need to pass a "data" variable to my ajax $.post() call. Where does "data" get set? And, what is in "data"?
One weird thing is that if I replace this line:
$stmt->bind_param("s", $email);
to this:
$stmt->bind_param("s", $_SESSION["email"]);
the email gets displayed...but I never store the email in the session anywhere! There isn't even an email field! Why would the latter work, and not the former?

Answer 1

You are looking for an e-mail (using an undefined variable $email) instead of the user, you probably want this:
$stmt = $mysqli->prepare("SELECT email FROM users WHERE username = ?");
$stmt->bind_param("s", $_SESSION["username"]);
instead of this:
$stmt = $mysqli->prepare("SELECT email FROM users WHERE email = ?");
$stmt->bind_param("s", $email);