0

Php doesn't support new versions of 'mysql' codes. Therefore, mysqli and PDO are recommended. I encountered this error while editing php 5 to 7 mysql>mysqli codes and I couldn't fix the problem. Where is your problem?

Error Message: Warning: mysqli_real_escape_string() expects parameter 1 to be mysqli, null given in

The system can't be logged on due to an error.

<?php
ob_start();
session_start();
define('DIR_APPLICATION', str_replace('\'', '/', realpath(dirname(__FILE__))) . '/');
if(!file_exists("config.php")){
    header("Location: install/index.php");
    die();
}
include(DIR_APPLICATION."config.php");
$msg = 'none';
$sql = '';
if(isset($_POST['username']) && $_POST['username'] != '' && isset($_POST['password']) && $_POST['password'] != ''){
    if($_POST['ddlLoginType'] == '1'){
        $sql= mysqli_query($link, "SELECT *,b.branch_name FROM tbl_add_admin aa left join tblbranch b on b.branch_id = aa.branch_id WHERE aa.email = '".make_safe($_POST['username'])."' and aa.password = '".make_safe($_POST['password'])."'");
    }
    if($_POST['ddlLoginType'] == '2'){
        $sql= mysqli_query($link,"SELECT *,b.branch_name FROM tbl_add_owner o left join tblbranch b on b.branch_id = o.branch_id WHERE o.o_email = '".make_safe($_POST['username'])."' and o.o_password = '".make_safe($_POST['password'])."'");
    }
    if($_POST['ddlLoginType'] == '3'){
        $sql= mysqli_query($link,"SELECT *,b.branch_name FROM tbl_add_employee e left join tblbranch b on b.branch_id = e.branch_id WHERE e.e_email = '".make_safe($_POST['username'])."' and e.e_password = '".make_safe($_POST['password'])."'");
    }
    if($_POST['ddlLoginType'] == '4'){
        $sql= mysqli_query($link,"SELECT *,b.branch_name FROM tbl_add_rent ad left join tblbranch b on b.branch_id = ad.branch_id WHERE ad.r_email = '".make_safe($_POST['username'])."' and ad.r_password = '".make_safe($_POST['password'])."'");
    }
    if($_POST['ddlLoginType'] == '5'){
        $sql=mysqli_query($link,"SELECT *,(select branch_name from tblbranch where branch_id = $_POST[ddlBranch]) as branch_name FROM tblsuper_admin WHERE email = '".make_safe($_POST['username'])."' and password = '".make_safe($_POST['password'])."'");
    }
    if($row = mysqli_fetch_array($sql)){
        //here success
        if($_POST['ddlLoginType'] == '5'){
            $arr = array(
                'user_id'       => $row['user_id'],
                'name'          => $row['name'],
                'email'         => $row['email'],
                'password'      => $row['password'],
                'branch_id'     => $_POST['ddlBranch'],
                'branch_name'   => $row['branch_name'],
                'added_date'    => $row['added_date']
            );
            $_SESSION['objLogin'] = $arr;
        }
        else{
            $_SESSION['objLogin'] = $row;
        }

        $_SESSION['login_type'] = $_POST['ddlLoginType'];

        if($_POST['ddlLoginType'] == '1' || $_POST['ddlLoginType'] == '5'){
            header("Location: dashboard.php");
            die();
        }
        else if($_POST['ddlLoginType'] == '2'){
            header("Location: o_dashboard.php");
            die();
        }
        else if($_POST['ddlLoginType'] == '3'){
            header("Location: e_dashboard.php");
            die();
        }
        else if($_POST['ddlLoginType'] == '4'){
            header("Location: t_dashboard.php");
            die();
        }
    }
    else{
        $msg = 'block';
    }

}
function make_safe($variable) 
{
   $variable = strip_tags(mysqli_real_escape_string($link, trim($variable)));
   return $variable; 
}
?>
Ahmet
  • 1
  • 2
    It may also be worth looking at prepared statments - https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php and https://stackoverflow.com/questions/32391315/is-mysqli-real-escape-string-enough-to-avoid-sql-injection-or-other-sql-attack – Nigel Ren Apr 29 '20 at 10:16
  • 2
    Please don't use `mysqli_real_escape_string`. Use prepared statements instead – Dharman Apr 29 '20 at 10:17

0 Answers0