PHP ve MySql GÜNCELLEME TimeStamp Sorgu

Question

Bu tablolarım var ve News tablosundan haber almak istiyorum, ancak kullanıcı & oturumunu girdikten sonra eklenen haberleri o Sorguya bağlı olarak görmedim PHP betiğinde gösterilir.

Kullanıcılar Sisteme giriş yaptıkları zaman Giriş Zaman damgasını kaydederler. Bir süre sonra servis, User_ID'nin yeni verileri hakkında sunucudan bilgi alır ve haberlerin görüldüğü tabloda görünmediği zamanki tabloyu kontrol eder ve Geçerli Zaman damgası, Zaman damgasıyla kaydedilmiş olandan daha büyüktür ve haber yeni olur.

Kullanıcılar Tablo

User_ID | User_Name |User_Login 
------------------------------- 
1  | John  |2016-04-13 16:01:12 
2  | Carl  |2016-04-13 16:13:22 
3  | Tomas  |2016-04-13 16:01:01 
4  | Adam  |2016-04-13 16:04:44 
5  | Nancy  |2016-04-13 16:04:37 

Haber Tablo

News_ID | News_Text  | News_Post_TimeStamp   
---------------------------------------------- 
1  | Hello World | 2016-04-13 16:09:23 
2  | This is My car | 2016-04-13 16:10:24 
3  | I had Ate pizza| 2016-04-13 16:11:40 
4  | Leave Me Alone | 2016-04-13 16:15:30 
5  | C++ Programming| 2016-04-13 16:09:50 

Görülme Tablo

ID | User_Id | News_Id 
--------------------------- 
1 | 1  | 2 
2 | 1  | 3 
3 | 4  | 1 
4 | 5  | 3 
5 | 1  | 4 

GÜNCELLEME Bu benim PHP Script Kod geçerli:

<?php 

require('config.php'); 
$conn = mysqli_connect($servername, $username, $password, $db); 
$query="SELECT * FROM news,users WHERE news.news_id NOT IN (SELECT news_id FROM seen WHERE user_id = '".$_GET['id']."') AND users.user_login<Now() "; 


$result = mysqli_query($conn,$query); 
$rows = array(); 
echo mysqli_error($conn); 

while($row = mysqli_fetch_assoc($result)) { 

    $rows[] = $row; 
} 

echo json_encode($rows); 
?> 

ve budur JSON Biçimi:

herkes nasıl yinelenen kaldırmak için bana söyleyebilir eğer Sonuçlar yinelenen bir vardır

[{"News_id":"1","News_Text":"C++programming","news_post_timestamp":"2016-  04-13 16:09:41","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"1","News_Text":"C++programming","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"},{"News_id":"2","News_Text":"Pizza","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"2","News_Text":"Pizza","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"},{"News_id":"3","News_Text":"Android","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"3","News_Text":"Android","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"},{"News_id":"4","News_Text":"Ahmad","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"4","News_Text":"Ahmad","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"},{"News_id":"5","News_Text":"Toto","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"5","News_Text":"Toto","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"},{"News_id":"6","News_Text":"JaVA","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"6","News_Text":"JaVA","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"},{"News_id":"7","News_Text":"Computer","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"7","News_Text":"Computer","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"},{"News_id":"8","News_Text":"Test","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"8","News_Text":"Test","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"},{"News_id":"9","News_Text":"Test","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"9","News_Text":"Test","news_post_timestamp":"2016-04-13 16:09:41","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"},{"News_id":"10","News_Text":"Al Hasasd","news_post_timestamp":"2016-04-13 16:47:44","User_Id":"14","User_Name":"John","user_login":"2016-04-13 16:04:37"},{"News_id":"10","News_Text":"Al Hasasd","news_post_timestamp":"2016-04-13 16:47:44","User_Id":"15","User_Name":"Carl","user_login":"2016-04-13 16:04:37"}] 

?

Answer 1

Kişisel SQL

SELECT * 
FROM news n 
WHERE news_id NOT IN (SELECT news_id FROM news_seen WHERE user_id = 1) 
AND News_Post_TimeStamp > (SELECT User_Login FROM user_table WHERE User_ID = 1) 

Ama sadece bunun için önce size, PHP kodu çünkü adapte etmelidir

---

(buna göre user_table uyarlamak) bu (USER_ID 1 ile exemple) ne olması gerektiğini sen SQL Injection için bir davetiye var.

İdeal olarak parameterized queries kullanmalısınız.

Ancak, USER_ID değerinizin sorguda alıntı yaptığınız gibi CHAR olduğunu varsayarak, kodunuza eklediğim bu basit sanitize işlevini kullanarak kodunuzu biraz daha güvenli hale getirebilirsiniz.

<?php 

require('config.php'); 
$conn = mysqli_connect($servername, $username, $password, $db); 

$userid = sanitize($_GET['id']); 
$query="SELECT * FROM news WHERE news_id NOT IN (SELECT news_id FROM news_seen WHERE user_id = '$userid') AND News_Post_TimeStamp > (SELECT User_Login FROM user_table WHERE User_ID = '$userid')"; 

$result = mysqli_query($conn,$query); 
$rows = array(); 
echo mysqli_error($conn); 

while($row = mysqli_fetch_assoc($result)) { 
    $rows[] = $row; 
} 

echo json_encode($rows); 




function sanitize($data) 
{ 
    // remove whitespaces (not a must though) 
    $data = trim($data); 

    // apply stripslashes if magic_quotes_gpc is enabled 
    if(get_magic_quotes_gpc()) 
    { 
    $data = stripslashes($data); 
    } 

    // a mySQL connection is required before using this function 
    $data = mysql_real_escape_string($data); 

    return $data; 
} 



?>