数组到字符串的转换(无法使其工作）

>ok 我正在尝试提取与登录用户名对应的特定数据行。 在我的页面上，我已经开始了我的会话，但由于某种原因我无法让代码工作.我不断得到"数组到字符串的转换"在"行上"，其中用户名 = '$_SESSION[用户]'"）;" 我做错了什么？如果我设置用户名=设置的用户名，它可以工作，但我需要它从会话ID中提取，以便它会根据登录者显示不同的值。

<?php 

require("common.php"); 

if(empty($_SESSION['user'])) 
{ 
    header("Location: login.php"); 

    die("Redirecting to login.php"); 
} 

?> 


<?php
$con=mysqli_connect("localhost","root","nathan","site");
// Check connection
if (mysqli_connect_errno())
{
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
$result = mysqli_query($con,"SELECT * FROM users
WHERE username = '".$_SESSION['user']."'");
while($row = mysqli_fetch_array($result))
{
 echo $row['username'] . " " . $row['att'];
echo "<br>";
}
?> 
here are my other corresponding files
<?php 

$username = "root"; 
$password = "nathan"; 
$host = "localhost"; 
$dbname = "site";


$options = array(PDO::MYSQL_ATTR_INIT_COMMAND => 'SET NAMES utf8'); 

try 
{ 

$db = new PDO("mysql:host={$host};dbname={$dbname};charset=utf8",                                                                                                $username,                        $password,             $options); 
} 
catch(PDOException $ex) 
{ 
    die("Failed to connect to the database: " . $ex->getMessage()); 
} 

$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); 

$db->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_ASSOC); 

if(function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) 
{ 
    function undo_magic_quotes_gpc(&$array) 
    { 
        foreach($array as &$value) 
        { 
            if(is_array($value)) 
            { 
                undo_magic_quotes_gpc($value); 
            } 
            else 
            { 
                $value = stripslashes($value); 
            } 
        } 
    } 
    undo_magic_quotes_gpc($_POST); 
    undo_magic_quotes_gpc($_GET); 
    undo_magic_quotes_gpc($_COOKIE); 
} 

header('Content-Type: text/html; charset=utf-8'); 

session_start(); 

和我的登录文件

<?php 

require("common.php"); 

$submitted_username = ''; 

if(!empty($_POST)) 
{ 
    $query = " 
        SELECT 
            id, 
            username, 
            password, 
            salt, 
            email 
        FROM users 
        WHERE 
            username = :username 
    "; 

    $query_params = array( 
        ':username' => $_POST['username'] 
    ); 
    try 
    { 
        $stmt = $db->prepare($query); 
        $result = $stmt->execute($query_params); 
    } 
    catch(PDOException $ex) 
    { 
        die("Failed to run query: " . $ex->getMessage()); 
    } 

    $login_ok = false; 

    $row = $stmt->fetch(); 
    if($row) 
    { 
        $check_password = hash('sha256', $_POST['password'] . $row['salt']); 
        for($round = 0; $round < 65536; $round++) 
        { 
            $check_password = hash('sha256', $check_password . $row['salt']); 
        } 
        if($check_password === $row['password']) 
        { 
            $login_ok = true; 
        } 
    } 

    if($login_ok) 
    { 
        unset($row['salt']); 
        unset($row['password']); 

        $_SESSION['user'] = $row; 

        header("Location: private.php"); 
        die("Redirecting to: private.php"); 
    } 
    else 
    { 
        print("Login Failed."); 

        $submitted_username = htmlentities($_POST['username'], ENT_QUOTES, 'UTF-8'); 
    } 
 } 
?> 
 <h1>Login</h1> 
<form action="login.php" method="post"> 
Username:<br /> 
<input type="text" name="username" value="<?php echo $submitted_username; ?>" /> 
<br /><br /> 
Password:<br /> 
<input type="password" name="password" value="" /> 
<br /><br /> 
<input type="submit" value="Login" /> 
</form> 
<a href="register.php">Register</a>