How to change mysql_num_rows etc functions to mysqli?

Question

I am facing an error as I'm about to launch my PHP files to a free web hosting site. The error showing up is given below:

And below is the code for my project.

    $sql= "SELECT * FROM user WHERE staff_id='$staff_id' AND password='$password'";
    $query = mysql_query($sql) or die("Error: " . mysql_error());  //this is error on line 42
    $row = mysql_num_rows($query);

I'm not sure what the errors are as I am self-taught on PHP. hopefully you guys can point out what change i should make. Thanks in advance!

In your text editor and Replace ALL **mysql** with **mysqli** — Madhur Bhaiya, Oct 03 '18 at 06:38
Your mysql_query also requires the database connection along with the sql query. So, mysqli_query($dbConnection, $sqlCode) — MichaelvE, Oct 03 '18 at 06:40

Parvej Alam · Answer 1 · 2018-10-03T11:21:02.407

0

    $sql= "SELECT * FROM user WHERE staff_id='$staff_id' AND password='$password'";
$query = mysql_query($sql) or die("Error: " . mysql_error());  //this is error on line 42
$row = mysql_num_rows($query);

try this one

$sql= "SELECT * FROM user WHERE staff_id='$staff_id' AND password='$password'";
$query = mysqli_query($con, $sql) or die("Error: " . mysqli_error($con)); // $con is the connection to database like  // $con = mysqli_connect("localhost","my_user","my_password","my_db");
$row = mysqli_num_rows($query);

edited Oct 03 '18 at 11:21

answered Oct 03 '18 at 06:44

Parvej Alam

258
2
8

Hi @ParvejAlam, could you please give more explanation to your answer? – toti08 Oct 03 '18 at 06:53
thanks!! i understand the logic behind this code! – abcd Oct 03 '18 at 07:43
i really appreciate if you understood. but as per my opinion the syntex have been changed in new php version. :) – Parvej Alam Oct 03 '18 at 11:20

Jules R · Accepted Answer · 2018-10-03T11:31:04.013

0

First, as you suggest in the title, use mysqli for security reasons, or even better, PDO.

With mysqli: (updated)

$stmt = $conn->prepare("SELECT COUNT(*) FROM user WHERE staff_id = :staff_id AND password = :password");
$res = $stmt->execute(["staff_id" => $staff_id, "password" => $password);
$row = mysqli_num_rows($res);

With PDO:

$stmt = $conn->prepare("SELECT COUNT(*) FROM user WHERE staff_id = :staff_id AND password = :password");
$res = $stmt->execute(["staff_id" => $staff_id, "password" => $password);
$row = $res->fetchColumn();

$conn being your database link. The PDO version assumes you don't need the rows but just the count. In case someone tells you to, don't use rowCount on SELECT query, that's not reliable.

edited Oct 03 '18 at 11:31

answered Oct 03 '18 at 07:01

Jules R

553
2
18

thank you for the explanation! very clear and simple to understand. thanks a lot! – abcd Oct 03 '18 at 07:42
1

You should be using prepared statements with mysqli as well; just throwing an `i` at the end does not make that more secure. – deceze Oct 03 '18 at 11:25
1

@deceze definitly you're right, updated the answer. – Jules R Oct 03 '18 at 11:31
1

Great! Except mysqli's prepare doesn't work that way: http://php.net/manual/en/mysqli.prepare.php – deceze Oct 03 '18 at 11:41
@deceze you can't put parameters in execute with mysqli ? – Jules R Oct 03 '18 at 11:49

How to change mysql_num_rows etc functions to mysqli?

2 Answers2