chazy@1337-h4x0r /var/www $ sudo chown -R chazy html
chazy@1337-h4x0r /var/www $ sudo chgrp -R www-data html
chazy@1337-h4x0r /var/www $ sudo chmod -R 750 html
chazy@1337-h4x0r /var/www $ sudo chmod g+s html
chazy@1337-h4x0r /var/www $ ls -l
total 4
drwxr-s--- 10 chazy www-data 4096 Dec 19 13:30 html

Options -Indexes

DirectoryIndex index.php

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

if ($stmt = $mysqli->prepare("  SELECT members.*, account_type.*, friends.*, friendsCount.*,
                                       COUNT(friendsCount.friendID) AS num_f
                                FROM members
                                INNER JOIN account_type ON account_type.id = ?
                                INNER JOIN friends ON friends.friendID = ?
                                INNER JOIN friends AS friendsCount ON friendsCount.userID = ?
                                WHERE members.id = ?")) {
 
    $stmt->bind_param('iiii', $_SESSION['acc_type'], $_GET['id'], $_SESSION['user_id'], $_GET['id']);
    $stmt->execute();
 
    $result = $stmt->get_result();
    $row = $result->fetch_array();
 
    $monthNames = array("Enero", "Febrero", "Marzo", "Abril", "Mayo", "Junio", "Julio", "Agosto", "Septiembre", "Octubre", "Noviembre", "Diciembre");
    $paid = array(); //Placeholder for paid months.
 
    for ($i = 1; $i < 13; $i++) {
 
        $month = 'month' . $i;
        $bonus_month = 'bonus_month' . $i;
 
        // check if the user received the monthly bonus
        if ($row[$bonus_month] == 0) {
 
            // check if the friend's member account is active
            if ($row['status'] == 1) {
 
                // check if the friend paid the month
                if ($row[$month] == 1) {
 
                    $paid[] = 'Pagado';
 
                    // check the user account type
                    if ($row['type'] == 'Base') {
 
                        // TODO: check if the friend is one of the three first (special promotion)
                        // (user gets double bonus for the first three invited friends)
                        if ($row['extra'] == 1) {
                            $extra = $row['bonus'] + 5;
                            $bonus[] = $extra . '€';
                        }
 
                        else {
                            $bonus[] = $row['bonus'] . '€';
                        }
                    }
 
                    else {
                        $bonus[] = $row['bonus'] . '€';
                    }
 
                    $cashed[] = 'No';
                    //$non_cashed[] = $bonus[];
                }
 
                else {
                    $paid[] = 'No Pagado';
                    $bonus[] = 'n/a';
                    $cashed[] = 'n/a';
                }
            }
 
            else {
                $paid[] = 'n/a';
                $bonus[] = 'n/a';
                $cashed[] = 'n/a';
            }
        }
 
        else {
            $paid[] = 'Pagado';
            $bonus[] = $row[$bonus_month] . '€';
 
            // TODO: find a way to check if user already received the bonus
            // 12 new columns? (bonus_received_month1-12)
            if (1 == 0) {
                $cashed[] = 'Si';
                //$total_cashed[] = $row[$bonus_month];
            }
 
            else {
                $cashed[] = 'No';
                //$non_cashed[] = $row[$bonus_month];
            }
        }
    }
 
    //Now make the HTML list
 
    foreach ($monthNames as $key => $month) {
 
        echo '
                <div class="list">
                    <ul>
                        <li><a class="month">' . $month . '</a></li>
                        <li><a class="status">' . $paid[$key] .'</a></li>
                        <li><a class="bonus">' . $bonus[$key] . '</a></li>
                        <li><a class="cashed">' . $cashed[$key] . '</a></li>
                    </ul>
                </div>';
    }
} else echo $mysqli->error;

// the number of friends
$count = $row['num_f'];
// the current friendID
$f_id = $_GET['id'];
$match = 'the first 3 ids (with acc status 1)';
 
if ($count > 2 && $f_id == $match) {
    $extra = $row['bonus'] + 5;
    $bonus[] = $extra . '€';
} else $bonus[] = $row['bonus'] . '€';

$non_cashed[] = $bonus[];
$total_cashed[] = $row[$bonus_month];
$non_cashed[] = $row[$bonus_month];
 
// not received
echo '<p>Total acumulado: ' . array_sum($non_cashed[]) . '€</p>';
// total received
echo '<p>Total recibido: ' . array_sum($total_cashed[]) . '€</p>';

SELECT user_uploads.* AS uu, members.*, COUNT(img_id, user_id) AS usr_liked, COUNT(img_id) AS total_likes
FROM user_uploads
INNER JOIN members AS m ON m.id = uu.user_id -- owner info
INNER JOIN img_likes AS il ON il.img_id = uu.imgID AND il.user_id = ? -- check if logged in user already liked
INNER JOIN img_likes AS ilt ON ilt.img_id = uu.imgID -- total likes
GROUP BY img_id, user_id
ORDER BY up_time DESC

if ($stmt = $mysqli->prepare("SELECT user_uploads.* AS uu, members.*, COUNT(img_id, user_id) AS usr_liked, COUNT(img_id) AS total_likes
                               FROM user_uploads
                               INNER JOIN members AS m ON m.id = uu.user_id
                               INNER JOIN img_likes AS il ON il.img_id = uu.imgID AND il.user_id = ?
                               INNER JOIN img_likes AS ilt ON ilt.img_id = uu.imgID
                               GROUP BY img_id, user_id
                               ORDER BY up_time DESC")) {
	$stmt->bind_param('i', $id);
	$Items = $stmt->execute(); // get photos
 
	foreach ($Items as $ItemInfo) {
 
		$liked = mysqli_num_rows($Items); // como hacerlo ahora?
		$total_likes = mysqli_num_rows($Items);
 
		$img_id = $aItemInfo['img_id'];
 
		if ($liked == 0) {
			$like = 'Me gusta';
		}
		else if ($liked == 1) {
			$like = 'Ya no me gusta';
		}
 
		$photo_list .= '
		// lista de fotos
		// boton like
		<span class="total_likes" id="lik' . $status_id . '">' . $totallikes . '</span>
		<a id="' . $total_likes . '" class="likes">' . $like . '</a>
		';
	}
}

if(isset($_GET['id'], $_SESSION['user_id'])) {
 
	/* prepare statement */
	if ($stmt = $mysqli->prepare("SELECT COUNT(*) rowCount FROM friends WHERE friendID = ? AND userID = ?")) {
		$stmt->bind_param('ii', $_GET['id'], $_SESSION['user_id']);
		$stmt->execute();
		/* bind variables to prepared statement */
		$stmt->bind_result($rowCount);
 
		/* fetch values */
		if($stmt->fetch()) {
			if ($rowCount > 0) {
 
				$stmt->close();
 
				if ($stmt = $mysqli->prepare("SELECT members.*, account_type.* FROM members INNER JOIN account_type ON account_type.type = members.acc_type
                                                                                                WHERE members.acc_type = ?")) {
				$stmt->bind_param('s', $_SESSION['acc_type']);
				$stmt->execute();
 
				$result = $stmt->get_result();
				$row = $result->fetch_array();
 
 
				if ($row['status'] == 1) {
					$status = 'Activa';
				} elseif ($row['status'] == 0) {
					$status = 'No Activa';
				}
 
				echo '<p>La cuenta esta ' . $status . ';
 
				$monthNames = array("Enero", "Febrero", "Marzo", "Abril", "Mayo", "Junio", "Julio", "Agosto", "Septiembre", "Octubre", "Noviembre", "Diciembre");
				$paid = array(); //Placeholder for paid months.
 
				for ($i = 1; $i < 13; $i++) {
					$month = 'month' . $i;
					$cashed_month = 'cashed_month' . $i;
					if($row[$month] == 1) {
						$paid[] = 'Pagado';
						$bonus[] = $row['bonus'] . '€';
					} else {
						$paid[] = 'No Pagado';
						$bonus[] = 'n/a';
					}
					if ($row[$cashed_month] == 1) {
						$cashed[] = 'Si';
					} elseif ($row[$month] == 1) {
						$cashed[] = 'No';
					} else {
						$cashed[] = 'n/a';
					}
				}
 
				//Now make the HTML list
 
				foreach($monthNames as $key => $month) {
					echo '
							<div class="list">
								<ul>
									<li><a class="month">' . $month . '</a></li>
									<li><a class="status">' . $paid[$key] .'</a></li>
									<li><a class="bonus">' . $bonus[$key] . '</a></li>
									<li><a class="cashed">' . $cashed[$key] . '</a></li>
								</ul>
							</div>';
				}
 
				echo '<div class="clear"></div>';
 
				echo '<p>Total recibido para ' . date('Y') . ': ' . $row['total'] . '€</p>';
 
				echo '<a href="/friend">Volver</a>';
 
			} else echo $mysqli->error;
 
			} else{
				echo $_SESSION['username'], ', no estás autorizado para ver la información de este socio ya que no es tu amigo...';
			}
		}
		/* close statement */
		$stmt->close();
	} else echo $mysqli->error;
	/* close connection */
	$mysqli->close();
}
 

<?php
 
if(isset($_GET['id'], $_SESSION['user_id'])){
	if (mysqli_connect_errno()) {
		printf("Connect failed: %s\n", mysqli_connect_error());
		exit();
	}
 
	$id = $_GET['id'];
	$connectedUserID = $_SESSION['user_id'];
 
	/* prepare statement */
	if ($stmt = $mysqli->prepare("SELECT COUNT(*) rowCount FROM friends WHERE friendID = ? AND userID = ?")) {
		$stmt->bind_param('ii', $id, $connectedUserID);
		$stmt->execute();
		/* bind variables to prepared statement */
		$stmt->bind_result($rowCount);
 
		/* fetch values */
		if($stmt->fetch()) {
			if ($rowCount > 0) {
				// zona segura
				echo 'It works!';
			} else{
				echo $_SESSION['username'], ', no estás autorizado para ver la información de este socio ya que no es tu amigo...';
			}
		}
		/* close statement */
		$stmt->close();
	}
	/* close connection */
	$mysqli->close();
} else {
	echo 'No estás autorizado para acceder a esta página';
 
	if (login_check($mysqli) == false) {
		echo '. Por favor, <a href="login">inicia sesión</a>.';
	} else{
		echo ' '.$_SESSION['username'];
	}
}
?>