get auto increment id from mysql table with PHP

Question

I have written a login script as below. Can anyone help me to get the current user id within below script? (auto increment id in mysql table). I'm unable to figure out any concept to work within below script, I also need the $_SESSION['user'] = $type; which is currently assigned and working fine, beside this I just want to add the auto increment id within a session variable without any authentication. I appreciate your help :)

login.php

    if(isset($_POST['email'], $_POST['password'], $_POST['type'])){

      $email = $_POST['email'];
      $password = $_POST['password'];
      $type = $_POST['type'];
      if(auth_user($email, $password, $type)){
        $_SESSION['user'] = $type;
            header('location: index.php');
      } else {
        echo '<span class="text-info success">Invalid email or password!</span>';
      }
    }

html fields

     <input type="text" class="form-control" placeholder="Enter Email" name="email" />
     <input type="password" class="form-control" placeholder="Enter Password" name="password" /><br />
     <input type="hidden" id="type" value="user" name="type" /><br />
     <button type="submit" class="btn btn-default" value="Login">Login </button>

functions.php

//auth user****
function auth_user($email, $password, $type){
     mysql_select_db('drive') or die(mysql_error());
     $sql = "SELECT `user`.`password` AS `pass` FROM `user` WHERE `user`.`email` = '$email' and `user`.`type` = '$type'";
     $result = mysql_query($sql) or die(mysql_error()); 
     $row = mysql_fetch_assoc($result);
     if($row['pass'] == $password){
         return true;
     } else {
         return false;
     }
}

@djay OOP is not here la, i mentioned it because my whole project is designed on OOP pattern. problem is solved thanks for ur 2nd comment first one was so dumb. — Sahed, Mar 20 '14 at 06:04

score 0 · Accepted Answer · edited May 23 '17 at 11:51

0

Change you query so that it fetch the user_id from the user table and return it.

 if($row['pass'] == $password){
     return $row['user_id'];
 } else {
     return false;
 }


  if($user_id = auth_user($email, $password, $type)){
    $_SESSION['user'] = $type;
    $_SESSION['user_id'] = $user_id;
    header('location: index.php');
  }

IMPORTANT : Your code is vulnable for sql injection!. Make necessary changes to avoid that

How can I prevent SQL injection in PHP?

edited May 23 '17 at 11:51

Community

1
1

answered Mar 20 '14 at 05:32

Nauphal

6,070
4
24
43

thanks for the answer, I hope it will work fine. but Im so dumb can you please do the necessary edit on $sql = "SELECT `user`.`password` AS `pass` FROM `user` WHERE `user`.`email` = '$email' and `user`.`type` = '$type'"; – Sahed Mar 20 '14 at 05:44
`SELECT user.id as user_id, user.password AS pass ...` – Nauphal Mar 20 '14 at 05:47

score -1 · Answer 2 · edited May 23 '17 at 12:03

Note:

Select and fetch the id column in your user table, then you can store it in your session variable.
You are prone to SQL injections. So at least use *_real_escape_string to prevent it.
You should use mysqli_* rather than using deprecated mysql_* API.
Why not store the id and type inside your session variables while inside your auth_user function?
Why do you have to fetch the password to do comparing and why not just check it in your query?

Use mysql_real_escape_string:

$email = mysql_real_escape_string($_POST['email']);
$password = mysql_real_escape_string$_POST['password']);
$type = mysql_real_escape_string$_POST['type']);

Your function:

function auth_user($email, $password, $type){

   mysql_select_db('drive') or die(mysql_error());
   $sql = "SELECT `id`, `user` FROM `user` WHERE `email` = '$email' AND `password` = '$password' AND `type` = '$type'";
   $result = mysql_query($sql) or die(mysql_error());  /* EXECUTE QUERY */

   if(mysql_num_rows($result > 0){ /* IF RESULTS WERE FOUND */
     $row = mysql_fetch_assoc($result);
     $_SESSION['user'] = $type;
     $_SESSION["id"] = $row['id'];
     return true;
   }
   else {
     return false;
   }

} /* END OF auth_user FUNCTION */

Recommendation:

Use password_hash to secure your password in your MySQL database.
Upgrade your API from mysql_* to mysqli_* prepared statement.

get auto increment id from mysql table with PHP

2 Answers2

Note:

Recommendation: