need completion of mysql database php assignment

projectfile/user.php

<?php class User { private $dbname; private $id; private $firstname; private $lastname; private $phone; private $age; private $address; private $city; private $state; private $zip; private $username; private $password; private $access; /* The constructor takes two parameters. If the second is a number, it uses that for the ID of the User object. If it is '', it uses the ID of the logged in user, if any. */ public function __construct($dbn,$uid='') { $this->dbname=$dbn; if(isset($_COOKIE['save'])) $_SESSION['userid'] = $_COOKIE['save']; if ($uid !== '') $id = $uid; else if (isset($_SESSION['userid'])) $id = $_SESSION['userid']; else return; $this->id = $id; require_once("db.php"); // check the path $db = new Database($dbn); $cn = $db->getConnection(); $query = "Select id,firstname,lastname,phone,age,address,city,state,zip,username,access from user WHERE id=$id;"; $rs = $cn->query($query); if (!$rs) die ('Error, could not retrieve user.'); $row = $rs->fetch_array(MYSQLI_ASSOC); $this->firstname = $row['firstname']; $this->lastname = $row['lastname']; $this->phone = $row['phone']; $this->age = $row['age']; $this->address = $row['address']; $this->city = $row['city']; $this->state = $row['state']; $this->zip = $row['zip']; $this->username = $row['username']; $this->access = $row['access']; } /* Accessor (getter) methods. */ public function getId() { return $this->id; } public function getFirstname() { return $this->firstname; } public function getLastname() { return $this->lastname; } public function getPhone() { return $this->phone; } public function getAge() { return $this->age; } public function getAddress() { return $this->address; } public function getCity() { return $this->city; } public function getState() { return $this->state; } public function getZip() { return $this->zip; } public function getUsername() { return $this->username; } public function getAccess() { return $this->access; } /* This returns an array of all of the useful fields of the object */ public function getAssoc() { $result=array(); $result['id'] = $this->id; $result['firstname'] = $this->firstname; $result['lastname'] = $this->lastname; $result['phone'] = $this->phone; $result['age'] = $this->age; $result['address'] = $this->address; $result['city'] = $this->city; $result['state'] = $this->state; $result['zip'] = $this->zip; $result['username'] = $this->username; $result['access'] = $this->access; return $result; } /* Mutator (setter) methods */ public function setFirstname($f) { $this->firstname=$f; } public function setLastname($l) { $this->lastname=$l; } public function setPhone($p) { $this->phone=$p; } public function setAge($a) { $this->age=$a; } public function setAddress($a) { $this->address=$a; } public function setCity($c) { $this->city=$c; } public function setState($s) { $this->state=$s; } public function setZip($z) { $this->zip=$z; } /* setUsername will first check for a duplicate username and return FALSE if it is, otherwise set the field and return TRUE */ public function setUsername($n) { require_once('db.php'); // check the path $db = new Database($this->dbname); $cn = $db->getConnection(); $n = $db->sanitize($n,'string'); $query = "SELECT id FROM user WHERE username='$n';"; if (!$rs=$cn->query($query)) { return FALSE; } if ($row = $rs->fetch_array(MYSQLI_ASSOC)) { return FALSE; } $this->username=$n; return TRUE; } public function setAccess($a) { $this->access=$a; } /* setPassword assumes that the username field has been set already. If a row with the username field in it is in the user table, the id is fetched and used to hash the password. If no row with the current username is in the table, a row is added with the username and auto_increment id. In either case, the id is returned. */ public function setPassword($p) { require_once('db.php'); // check the path $db = new Database($this->dbname); $cn = $db->getConnection(); $query = "SELECT id FROM user WHERE username='{$this->username}';"; $rs = $cn->query($query); if (!$rs) die ("problem in setPassword after select"); if ($row = $rs->fetch_array(MYSQLI_ASSOC)) { $id = $row['id']; } else { $query2 = "INSERT INTO user (username) VALUES ('{$this->username}');"; $rs2 = $cn->query($query2); if (!$rs2) die ("Cannot insert a user in setPassword"); $rs = $cn->query($query); if (!$rs) die ("problem in setPassword after new row select"); if ($row = $rs->fetch_array(MYSQLI_ASSOC)) { $id = $row['id']; } } $this->password=$this->passhash($p,$id); return $id; } /* The user is sent to another URL if the session variable is not set. */ public function loginCheck($failpage){ if (!isset($_SESSION['userid'])) header("Location: $failpage"); } /* passhash hashes passwords, given the password and the user id. */ private function passhash($p,$i) { $salt = "81b2((&75e33044a"; $sitekey = "d91791c4bc5d9f3601c587f227aa57f6cf270482244eb41ed3380262bcd829ef"; return hash_hmac('sha512',$p . $i . $salt, $sitekey); } /* login takes the username, password, location for successful logins, location for failed logins, and a boolean representing whether the user wants to save their login as a cookie. If the username is not found, the login fails. If the (hashed) password for that username does not match the (hashed) password in the DB, the login fails. If the username and password match, a session variable is saved with the ID, and a cookie is set if the user wants to remain logged in. */ public function login($uname,$password,$passloc,$failloc,$wanttosave){ require_once('db.php'); // check the path $db = new Database($this->dbname); $cn = $db->getConnection(); $uname = $db->sanitize($uname,'string'); $query = "SELECT id FROM user WHERE username='$uname';"; $rs = $cn->query($query); if (!rs) header("Location: $failloc"); if ($row = $rs->fetch_array(MYSQLI_ASSOC)) $id = $row['id']; else header("Location: $failloc"); $pw = $this->passhash($password,$id); $query1 = "SELECT * FROM user WHERE username='$uname' and password='$pw';"; if ($rs=$cn->query($query1)){ $row = $rs->fetch_array(MYSQLI_ASSOC); if ($row){ if ($wanttosave) setcookie('save',$id,time()+365*24*60*60); $_SESSION['userid']=$id; header("Location: $passloc"); } else { header("Location: $failloc"); } } } /* insert assumes that a row with the new unique username has been inserted, and that the matching id is $id */ public function insert($id) { require_once('db.php'); // check the path $db = new Database($this->dbname); $cn = $db->getConnection(); $query = "UPDATE user SET firstname=?, lastname=?, phone=?, age=?, address=?, city=?, state=?, zip=?, username=?, password=?, access=? WHERE id=$id;"; $stmt = $cn->prepare($query); $stmt->bind_param("sssisssssss",$this->firstname,$this->lastname,$this->phone,$this->age,$this->address, $this->city,$this->state,$this->zip,$this->username,$this->password, $this->access); $rs = $stmt->execute(); if (!$rs) return FALSE; return TRUE; } }