php - "AND $_SESSION['user_id'] = posted_by" not working -
basically have site people can post topics or discussions, have added edit_post feature working fine, in testing realized changing url people edit other peoples posts, have tried implement check person made post can edit it, not having luck, i'm not getting errors, it's not letting other users edit, it's not letting topic creator edit either.
if ( isset($_get['edit'])) { $id = $_get['edit']; $res = mysql_query("select users.user_id, users.username, users.profile, topics.topic_id, topics.category, topics.sub_category, topics.subsub_category, topics.topic_data, topics.posted_by, topics.posted, topics.view, topics.invisipost `topics` join `users` on topics.posted_by = users.user_id topic_id='$id'"); $rows = mysql_fetch_array($res); } if ( isset($_post['topic_data'])) { $topic_data = $_post['topic_data']; $id = $_post['id']; $sql = "update topics set topic_data='$topic_data' topic_id='$id' , '".$_session['user_id']."'='$posted_by'"; $res = mysql_query($sql) or die("could not update".mysql_error()); header("location: view_topic.php?topic_id=$id"); }
your query should this:
"update topics set topic_data='$topic_data' topic_id='$id' , posted_by ='".$_session['user_id']."'";
because posted_by column...
Comments
Post a Comment