PDO prepare() error Php / Mysql

Question

PHP

session_start(); 
$username = $_POST['regduser']; 
$userpass = md5($_POST['regdpass']); 
$sql = $sql->prepare("SELECT * from Students WHERE regduser='$username' and regdpass='$userpass'");
$sql->bindParam(':username', $username);
$sql->bindParam(':userpass', $userpass);
$stmnt->execute();
$result = mysql_query($sql); 
if (mysql_num_rows($result)!= 1) { 
 $error = "Login failed"; 
 #include "loginform.php"; 
} else { 
    echo "<h1>exists</h1>";
 #$_SESSION['regduser'] = "$username"; 
 #$_SESSION['ip'] = $_SERVER['REMOTE_ADDR']; 
 // any other data needed to navigate the site or 
 // to authenticate the user can be added here 
 #include "membersection.php"; 
}

?>

HTML:

<form action="inc/check_regUsr.php" method="post" id="userLogon">
    <div class="field required">
        Username: <input type="text" name="regduser" tabindex="1" /><br />
        </div>
        <div class="field required">
        Password: <input type="password" name="regdpass" tabindex="2" /><br />
        </div>
        <input type="submit" name="submitUser" />
</form>

Fatal error: Call to a member function prepare() on a non-object on line 9 That line is:

$sql = $sql->prepare("SELECT * from Students WHERE regduser='$username' and regdpass='$userpass'");

What am I doing wrong here?!

score 5 · Accepted Answer · answered Aug 03 '11 at 22:51

5

Ohoh, where to begin...

Where is the database connection $sql made?
Use :placeholdername in prepared statements, not $placeholdername.
You are overwriting $sql, destroying your database connection if you ever had one.
$stmnt does not exist
What does mysql_query do there? You have 3 options: mysql, mysqli or PDO. Stick with one, don't mix & match.

answered Aug 03 '11 at 22:51

Wrikken

69,272
8
97
136

Thanks for the tips. Where's a good place to learn PDO better OTHER than Php.net? – Jshee Aug 04 '11 at 00:08

score 2 · Answer 2 · edited May 23 '17 at 11:55

2

$sql is not an object at all. It has to be an object, like something from PDO, e.g. $sql = new PDO(…).

Furthermore, you should not use MD5 hashes for passwords, see Secure hash and salt for PHP passwords.

edited May 23 '17 at 11:55

Community

1
1

answered Aug 03 '11 at 22:53

Shi

4,178
1
26
31

PDO prepare() error Php / Mysql

2 Answers2