diff --git a/app/public/delete_user.php b/app/public/delete_user.php index 3d2b9b4..317b0ed 100644 --- a/app/public/delete_user.php +++ b/app/public/delete_user.php @@ -6,8 +6,11 @@ if($_SERVER['REQUEST_METHOD'] == "POST") { try { - $stmt = $con->prepare("DELETE FROM users WHERE id = :id"); - $stmt->execute(['id' => $_POST['id']]); + $selected_user_id = get_id_user_by_user_id($con, $_SESSION['user_id']); + if($selected_user_id != $_POST['id']) { + $stmt = $con->prepare("DELETE FROM users WHERE id = :id"); + $stmt->execute(['id' => $_POST['id']]); + } } catch(PDOException $e) { handle_pdo_exception($e); } diff --git a/app/scripts/database_queries.php b/app/scripts/database_queries.php index 74092e5..f716142 100644 --- a/app/scripts/database_queries.php +++ b/app/scripts/database_queries.php @@ -529,4 +529,16 @@ function get_result_team_station($con, $s_id, $m_id) { } catch( PDOException $e) { handle_pdo_exception($e); } +} + +function get_id_user_by_user_id($con, $user_id) { + try { + $stmt = $con->prepare("SELECT * FROM users WHERE user_id = ?"); + $stmt->bindParam(1, $user_id, PDO::PARAM_STR); + $stmt->execute(); + $stmt->setFetchMode(PDO::FETCH_ASSOC); + return $stmt->fetch()['id']; + } catch( PDOException $e) { + handle_pdo_exception($e); + } } \ No newline at end of file