mysqli_num_rows Function

Question

I'm stucked... hope for some help.

I have problem with this situation. I've been following a tutorial to add in a search feature for my website, but I've been getting the following error:

Warning: mysqli_num_rows() expects parameter 1 to be mysqli_result, boolean given in C:\xampp\htdocs\registracija\index.php on line 48

Here is my code:

if ($password_form==$repassword_form) {

    $user=mysqli_query(
         $con,
         "SELECT * FROM users,
          WHERE username=username_form
          OR email=email_form
      ");
    $counter=mysqli_num_rows($user);
    if ($counter==0) {

      if (move_uploaded_file($temporary_name, $path)) {
            echo "YES!<br />";
          }       
          else   {
            echo "NO!<br />";
    }       
  } 
  else   {
        echo "ERROR!<br />Some Message!<br />";
   }

 }   
 else   { echo "ERROR!<br />Some Message!<br />";
 }
}
else { 
?>

Your query failed, your code assumes that nothing could ever go wrong, and now you're suffering from the consequences of assuming things. — Marc B, Sep 19 '16 at 16:39
Looks like it's a very bad tutorial. Either way you should check for mysql errors and then rewrite your SQL query. — Your Common Sense, Sep 19 '16 at 16:39

The One and Only ChemistryBlob · Answer 1 · 2016-09-19T17:32:10.253

0

There is an error in your query, change this:

"SELECT * FROM users,
      WHERE username=username_form
      OR email=email_form
  "

to this to remove the comma:

"SELECT * FROM users
      WHERE username=username_form
      OR email=email_form
  "

In addition, username_form and email_form seem to likely be strings, so your final query probably should look like this:

"SELECT * FROM users
      WHERE username = '$username_form'
      OR email = '$email_form'
  "

Your query is failing, and then you're trying to execute an operation mysqli_num_rows(), on this.

You should strongly consider a prepared statement to avoid SQL injection:

$stmt = $db->prepare("SELECT * FROM table WHERE username=:un AND email=:em");
$stmt->execute(array(':un' => $username_form, ':em' => $email_form));
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);

Read more about SQL injection from this excellent article here.

edited Sep 19 '16 at 17:32

answered Sep 19 '16 at 16:39

The One and Only ChemistryBlob

7,864
10
36
69

To warrant the UV you might like to add a dollar or 2 onto the relevant variables as well – RiggsFolly Sep 19 '16 at 16:48
1

And probably some single quotes around those variables as well as they are almost definitely `text` – RiggsFolly Sep 19 '16 at 16:49
Ok I will do the adding of the dollar – RiggsFolly Sep 19 '16 at 16:54
Was just about to do that...thanks :) – The One and Only ChemistryBlob Sep 19 '16 at 16:54
Yet another answer that effectively promotes an sql injection. – Your Common Sense Sep 19 '16 at 16:56
@Your Common Sense, yes you're right, I just updated – The One and Only ChemistryBlob Sep 19 '16 at 17:32

mysqli_num_rows Function

1 Answers1