Why there is a PHP Warning for this code and how to prevent this from mysql injections?

Question

I have the following code in my file. It reurns nothing but blank.. when I check error log file I see this:

PHP Warning:  mysqli_fetch_assoc() expects parameter 1 to be mysqli_result, boolean given in

.

 <?php
    include "dbfilepath";
    $con = mysqli_connect($server, $db_user, $db_pwd, $db_name);
    $username = $_SESSION['username'];
    $sql = "SELECT FROM users WHERE username='$username'";
    $data = mysqli_query($con, $sql);
    $row = mysqli_fetch_assoc($data);
    ?>

why is that? for me it looks all fine..

and how to secure this simple code from sql injections?

try to `echo $sql = "SELECT FROM users WHERE username='$username'";` to check it valid or not. I think you are not getting `$_SESSION['username']` — urfusion, Dec 11 '17 at 08:27
The manual states that it can return boolean. http://php.net/manual/en/mysqli.query.php — Andreas, Dec 11 '17 at 08:27
use prepared statements to avoid sql injection rather than embedding variables directly in the sql — Professor Abronsius, Dec 11 '17 at 08:28
See whether a mysql error occured - that might be the reason for mysqli_query returning a boolean — Nico Haase, Dec 11 '17 at 08:29
@duskwuff go on, make the next move and vote to close it with whatever reason you find more appropriate — Your Common Sense, Dec 11 '17 at 09:11

score 2 · Accepted Answer · answered Dec 11 '17 at 08:27

2

  $sql = "SELECT * FROM users WHERE username='$username'";

you forgot to set something to select

to secure it you need to use prepared statements for the variable $username

answered Dec 11 '17 at 08:27

pr1nc3

8,108
3
23
36

score 0 · Answer 2 · answered Dec 11 '17 at 10:06

Posting it as an answer due to less reputation.

Firstly , you have incorrect syntax for query in select because you don't identify which col name you want to select like users_name or etc . if you get all records your just write with '*'

"SELECT * FROM users...";

or other answer by the using of prepared statements IN 'PDO' you save from SQL injection because through prepared statements you query will be with secure param .

Why there is a PHP Warning for this code and how to prevent this from mysql injections?

2 Answers2