php - 如何从 $_SESSION 和 MySQL 用户 ID 验证用户 ID

Question

我对 MySQL 查询和条件有疑问。主要问题是具有另一个 ID 的用户可以查看/编辑相同的潜在客户，即使他的 id ！= 所有者。

我尝试更改变量并添加“”或“”，但这些都没有帮助。

$myuser_query = mysqli_query($conn,"SELECT * FROM users WHERE id = '".$_SESSION["id"]."'");
$myuser = mysqli_fetch_assoc($myuser_query);

$myleads = "SELECT * FROM leads WHERE owner = '".$myuser["id"]."' AND status = 1 OR status = 2 ORDER BY RAND() LIMIT 1";
$newleads = $conn->query($myleads);
 if ($newleads->num_rows >= 1) {

（这里是显示日期的所有客户端。）

标签： phpmysql

Answer 1

您需要OR在查询中的条件周围添加括号。改变这个：

$myleads = "SELECT * FROM leads 
           WHERE owner = '".$myuser["id"]."' AND status = 1 OR status = 2 
           ORDER BY RAND() LIMIT 1";

至：

$myleads = "SELECT * FROM leads 
           WHERE owner = '".$myuser["id"]."' AND (status = 1 OR status = 2)
           ORDER BY RAND() LIMIT 1";