sqlsrv_num_rows() expects parameter 1 to be resource

Question

I get a error --> sqlsrv_num_rows() expects parameter 1 to be resource
Can anyone figure out whats wrong with the coding, ive been trying for 3 hours now Thanks in advance :)

<?php
include("config.php");

 username and password sent from form 
 $myusername=htmlspecialchars($_POST[username]); 
 $mypassword=htmlspecialchars($_POST[password]); 



 $sql="SELECT * FROM Login WHERE Username=$myusername and 
  Password=$mypassword";
  $result=sqlsrv_query($conn,$sql);
  $count=sqlsrv_num_rows($result);

  if($count==1){
     header("location: something");
  }
 else {
     echo "Wrong Username or Password";



 } 
 ?>

CONFIG.PHP

 <?php
   $serverName = ''; 
   $uid = '';   
   $pwd = '';  
   $databaseName = ''; 
   $connectionInfo = array( "UID"=>$uid,                            
                     "PWD"=>$pwd,                            
                     "Database"=>$databaseName); 

   $conn = sqlsrv_connect( $serverName, $connectionInfo);
      if( $conn ) {
            echo "Connection established.<br />";
       }else{
              echo "Connection could not be established.<br />";

        }
        ?>

`$result` is probably false, meaning your query failed, which seems likely if that's actually your SQL query. — Jonnix, Jul 04 '17 at 12:43
Possible duplicate of [SQLSRV\_NUM\_ROWS error](https://stackoverflow.com/questions/22858327/sqlsrv-num-rows-error) — alpakyol, Jul 04 '17 at 12:54

score 1 · Accepted Answer · answered Jul 04 '17 at 12:45

1

sqlsrv_num_rows() expects parameter 1 to be resource

The issue is $result is false and it is because of:

$sql="SELECT * FROM Login WHERE Username=$myusername and 
  Password=$mypassword";

here Username and Password are strings and you to compare with string you have to wrap the values in ' singe quotes like:

$sql="SELECT * FROM Login WHERE Username='".$myusername."' and 
  Password='".$mypassword."'";

Note: Your query is vulnerable to sql injections

answered Jul 04 '17 at 12:45

Mayank Pandeyz

25,704
4
40
59

OMG THANKS! What could i do to prevent sql injections? – Elo97234c Jul 04 '17 at 12:50
Check this: https://stackoverflow.com/questions/16202006/prevention-of-sql-injection-with-php-for-sql-server-and-without-pdo – Mayank Pandeyz Jul 04 '17 at 12:52

score 0 · Answer 2 · answered Jul 04 '17 at 13:30

I have notice 2 things here:

1) You have a typo at line 4, I think you missed the comment markup

instead of:

username and password sent from form

you mean:

// username and password sent from form

2) Mayank already anwsered that second issue. You have another typo at SQL Query and the $result variable is returning FALSE instead of a statement resource

You could verify that checking if $result is equal to FALSE, and furthermore print some error for the user, like this:

if( $result === false ) {
     die( print_r( sqlsrv_errors(), true));
}

Check this link for more information.

Finally mind what Mayank said about SQL injection.

sqlsrv_num_rows() expects parameter 1 to be resource

CONFIG.PHP

2 Answers2