php - 只允许指定用户访问页面

Question

我在制作一个只有乐队成员才能访问他们自己的乐队页面的页面时遇到问题。

我的乐队表中的每个乐队都有四列 $bandm1 $bandm2 $bandm3 和 $bandm4。

我尝试制作一个脚本来绘制会话用户名，然后从 url 中绘制 band_id，并且成功。但是当我尝试时：

脚本不起作用。我的 AND/OR 语句有问题吗？

编辑：这是我的完整代码：

        $user = $_SESSION['user_name'];
    $get_user = "
select * 
  from users 
 where user_name = '$user'
"; 
    $run_user = mysqli_query($con,$get_user);
    $row=mysqli_fetch_array($run_user);

    $user_name = $row['user_name'];

if(isset($_GET['band_id'])) {
$band_id = mysqli_real_escape_string($con, $_GET['band_id']);
if (ctype_alnum($band_id)){
    $q =  "SELECT * FROM bands WHERE band_id = '$band_id' ";

$r = mysqli_query($con, $q);
if($r){
while($row=mysqli_fetch_array($r)){
            $band_id = $row['band_id'];
            $band_name = $row['band_name'];
        }
}

}
?>

FROM bands 
WHERE band_id = '$band_id' 
      and (bandm1 = $user_name) OR (bandm2 = $user_name) 
          OR (bandm3 = $user_name) OR (bandm4 = $user_name)

它有效，但是当我将选择替换为： SELECT * FROM band WHERE band_id = '$band_id' and (bandm1 = $user_name) OR (bandm2 = $user_name) OR (bandm3 = $user_name) OR (bandm4 = $user_name) ";

它停止工作

Answer 1

尝试在查询中添加括号：

SELECT * FROM bands WHERE band_id = '$band_id' and ( (bandm1 = $user_name) OR (bandm2 = $user_name) OR (bandm3 = $user_name) OR (bandm4 = $user_name) )

编辑 ：

您可能需要在这些变量周围加上引号，不确定您的脚本是如何构建的，但类似这样：

$query = "SELECT * FROM bands WHERE band_id = '".$band_id."' and ( bandm1 = '".$user_name."' OR bandm2 = '".$user_name."' OR bandm3 = '".$user_name."' OR bandm4 = '".$user_name."' )";