Profile user php

Question

I'm trying to build a page for user profiles, but I'm having difficulties.
I do not want to create the profile for the user just logged, but permanent user profiles, where you can then watch them all.

type: profile.php? id = 1

I'm using UserPie, which can be found on github.

Actually my profile.php page is this:

<?php require_once("models/config.php"); 

$id = $_GET['id']);

if (empty($_GET['id'])){
    header("Location: index.php");
    die();
}

$sql = "SELECT * FROM users WHERE user_id != '$id'";
$result = mysqli_query($db, $sql) or die(mysqli_error($db));
while($rws = mysqli_fetch_array($result)){ 

?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title><?php echo $rws["username"]; ?> - <?php echo $websiteName; ?></title>
<?php require_once("head_inc.php"); ?>
</head>
<body>
<?php require_once("navbar.php"); ?>

<?php if (is_null($sql)): ?>
<h3 class="page-header">ERROR</h3>
User not found!
<?php else: ?>

<h1>Welcome</h1>
<p>ID: <?php echo $rws['user_id']; ?></p>       
<p>Welcome to your account page <strong><?php echo $rws['username']; ?></strong></p>
<p>You joined on <?php echo date("l \\t\h\e jS Y", $rws['sign_up_date']); ?> </p>       
<?php endif; ?>
<?php } ?>

I cannot make it work.
Do you have any suggestion?

I solved in this way:

$sql = "SELECT * FROM users WHERE user_id = '$id'";
$result = $db->sql_query($sql);
while($rws = mysqli_fetch_array($result)){

Welcome to Stack. in your code "if (is_null($sql)):" is definitley wrong. But back to your question which is not really clear. To store the data permanently you can store them into data bases. — B001ᛦ
@Marco $id = $_GET['id']); there is a syntax error. it will be $id = $_GET['id']; Do you have any error?? then it will be easy for some one to give solution. — Tintu C Raju
@D4V1D $sql is a string, isn't it? and here you always go through this line, so that $sql contains the string, otherwise with an empty $_GET['id'] it will stop beacause of the die() — B001ᛦ

rockerBOO rockerBOO · Accepted Answer · 2015-03-27T12:09:28

$sql = "SELECT * FROM users WHERE user_id != '$id'";
$result = mysqli_query($db, $sql) or die(mysqli_error($db));

Since you are expect only 1 response, you can just get the 1 result and not loop through them. $result is false on query failure. The result is a MysqliResult object, which has the num_rows member variable which states the number of results.

if ($result && $result->num_rows > 0) {
    $rws = mysqli_fetch_array($result);

    // Output template/html here
} else {
    // ERROR could not find
}

Additionally $sql = "SELECT * FROM users WHERE user_id != '$id'"; is exploitable with SQL Injection. To avoid this use the prepared statements in mysqli Prepared Statements - PHP.net

Profile user php

1 Answers