<?php

$host = "localhost";
$db = "user_test_db";
$user = "root";
$password = "";

$link = mysqli_connect($host, $user, $password, $db);

if(!$link){
    die(mysqli_connect_error());
}

//var_dump($link);

$qStr = "SELECT user_id, user_first_name, user_email, user_last_name FROM users";

$result = mysqli_query($link,$qStr);

if(!$result){
    die(mysqli_error($link));
}
//var_dump($result);
/*
if(mysqli_num_rows($result) > 0){
    while($row = mysqli_fetch_assoc($result)){
        //var_dump($row);
        echo($row['user_first_name']);
    }

}
*/
$users = array();
if(mysqli_num_rows($result) > 0){
    while($row = mysqli_fetch_assoc($result)){
        $u = array();
        $u['user_first_name'] = htmlentities($row['user_first_name']);
        $u['user_last_name'] = htmlentities($row['user_last_name']);
        $u['user_id'] = htmlentities($row['user_id']);   
        $u['user_email'] = htmlentities($row['user_email']);
        $users[] = $u;  
    }
}
var_dump($users);


// FINALLY, here's how you might display the data on the page
// here's how you could use the data to create a table
echo("<table border=\"1\">");
foreach($users as $u){
	echo("<tr>");
	echo("<td>{$u['user_first_name']}</td>");
    echo("<td>{$u['user_last_name']}</td>");
    echo("<td>{$u['user_email']}</td>");
	echo("<td><a href=\"user_details.php?user_id={$u['user_id']}\">EDIT</a></td>");
	echo("</tr>");
}
echo("</table>");


// I used this to do an XXS attack....
$qStr = "update users set user_email = '<script>location.href=\"http://www.yahoo.com\";</script>' where user_id = 2";
//$qStr = "update users set user_email = 'jane@doe.com' where user_id = 2";
$result = mysqli_query($link, $qStr);
if(!$result){
	die(mysqli_error($link));
}
echo(mysqli_affected_rows($link));
var_dump($result);


?>