Reply to thread

Message

<blockquote data-quote="Markshall" data-source="post: 235006" data-attributes="member: 1872">I think you'd have to do:[PHP]&lt;?php$rank = mysql_result(mysql_query(&quot;SELECT `rank` FROM `users` WHERE `id` = '&quot; . $_SESSION['id'] . &quot;'&quot;), 0) or die(mysql_error());if ($rank &gt; 3) {&nbsp; &nbsp; echo 'lol';}?&gt;[/PHP]Another thing you should do is sanitize your $_SESSION variables, you can do this in a global file and then include it into each PHP file where you will be using a database query. This is because I'm sure users can change $_SESSION data and change it to be able to do SQL injections. Either that or look into <a href="http://php.net/manual/en/book.mysqli.php" target="_blank">MySQLi</a> and specifically check out prepared statements.I usually create a class aimed at users and create a method called getRow or something which accepts 2 parameters, the user ID and the row to fetch a value from, the method will then return the value of the row, if any.</blockquote>

[QUOTE="Markshall, post: 235006, member: 1872"] I [B]think[/B] you'd have to do: [PHP]<?php $rank = mysql_result(mysql_query("SELECT `rank` FROM `users` WHERE `id` = '" . $_SESSION['id'] . "'"), 0) or die(mysql_error()); if ($rank > 3) { echo 'lol'; } ?>[/PHP] Another thing you should do is sanitize your $_SESSION variables, you can do this in a global file and then include it into each PHP file where you will be using a database query. This is because I'm sure users can change $_SESSION data and change it to be able to do SQL injections. Either that [b]or[/b] look into [URL='http://php.net/manual/en/book.mysqli.php']MySQLi[/URL] and specifically check out prepared statements. I usually create a class aimed at users and create a method called getRow or something which accepts 2 parameters, the user ID and the row to fetch a value from, the method will then return the value of the row, if any. [/QUOTE]

Verification

Reply to thread

Connect with us

Newest members