php not getting user info from database

Question

The database information is correct and working, I've tested this several times. The database exists along with the table i am trying to pull data out of. I have dummy information in the database, here is my code to check if the user in the database 'network', table 'users':

<?php 
require 'core/init.php';

if (empty($_POST) === false){
    $username = $_POST['username'];
    $password = $_POST['password'];

    if (empty($username) === true || empty($password) === true) {
        $errors[] = 'You need to enter a username and password.';
    } else if (user_exists($username) === false) {
        $errors[] = 'Username does not exists. Have you registered?';
    } else if (user_active($username) === false) {
        $errors[] = 'Your account is not activated. Please check your email!';
    } else {

    }

    print_r($errors);
}
?>

Here is the code for the functions 'user_exists($username)'

<?php


function user_exists($username) {
    $username = sanitize($username);
    return (mysql_result(mysql_query("SELECT COUNT('user_id') FROM 'users' WHERE 'username' = '".$username."'"), 0) === 1) ? true : false;
}

function user_active($username) {
    $username = sanitize($username);
    return (mysql_result(mysql_query("SELECT COUNT('user_id') FROM 'users' WHERE 'username' = '".$username."' AND 'active' = 1"), 0) === 1) ? true : false;
}
?>

sanitize function:

<?php
function sanitize($data) {
    return mysqli_real_escape_string($data);
}
?>

Here is my issue:

When I login with the dummy information - Username; Password (md5 hashed via phpmyadmin) if displays the error:

'Username does not exists. Have you registered?'

I have tried using a different database, a different user.. nothing works.. Help!

Replace the single quotes from column name and table name with back tick `. Also take a look at this link: dev.mysql.com/doc/refman/5.5/en/reserved-words.html — vee
– vee, Commented Dec 6, 2013 at 21:01
Combine the two answers below :) Edit: Somebody removed the second one. — Lorenz
– Lorenz, Commented Dec 6, 2013 at 21:05
Give us the MySQL error: "echo mysql_error();" after the user_exists call. — Lorenz
– Lorenz, Commented Dec 6, 2013 at 21:11

Mihai · Accepted Answer · 2013-12-06 21:30:12Z

1

Use back ticks for column and table names,not quotes.

"SELECT COUNT(`user_id`) FROM `users` WHERE `username` = '".$username."'")

return (mysql_result(mysql_query("SELECT COUNT('user_id') 
FROM 'users' WHERE 'username' = '".$username."'"), 0) === 1) ? true : false;
}

mysql_results returns either a cell or false,so above the condition ===1 is never reached.

Docs

Returns the contents of one cell from a MySQL result set on success, or FALSE on failure.

return (mysql_result(mysql_query("SELECT COUNT('user_id') 
FROM 'users' WHERE 'username' = '".$username."'"), 0) == false) ? false: true;
}

Also you are connecting with mysql and using mysqli_real_escape_string in the sanitize function. Dont mix them.

edited Dec 6, 2013 at 21:30

answered Dec 6, 2013 at 21:02

Mihai

26.8k8 gold badges71 silver badges87 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

PrivateMufasa Over a year ago

That didnt make a difference. I still get user does not exists.

Justin E Over a year ago

This coding practice promotes sql injection.

PrivateMufasa Over a year ago

@JustinE this isnt a live project, this is a learning project.

Lorenz Over a year ago

@JustinE No it doesn't. He sanitizes the output.

PrivateMufasa Over a year ago

got it, thanks. it was the sanitation mysqli_* that was causing the problem, i changed it to mysql_. I tried turning mysql_ to mysqli_*, but mysqli_result doesnt seem to like this line: return (mysqli_result(mysqli_query("SELECT COUNT(user_id) FROM users WHERE username = '".$username."'"), 0) == 1) ? true : false; -- it shows mysqli_result as an invalid command. Ill work it out. Thanks!

Lorenz · Accepted Answer · 2013-12-06 21:08:28Z

0

function user_exists($username) {
    $username = sanitize($username);
    return (mysql_result(mysql_query("SELECT COUNT(`user_id`) FROM `users` WHERE `username` = '".$username."'"), 0) == 1) ? true : false;
}

function user_active($username) {
    $username = sanitize($username);
    return (mysql_result(mysql_query("SELECT COUNT(`user_id`) FROM `users` WHERE `username` = '".$username."' AND `active` = 1"), 0) == 1) ? true : false;
}

What was done:

Replaced '' for column names with `
Used == instead of ===

answered Dec 6, 2013 at 21:08

Lorenz

2,2793 gold badges20 silver badges18 bronze badges

Comments

Justin E · Accepted Answer · 2013-12-06 21:12:50Z

0

PDO:

function user_exists($username) {
    $db = new PDO('mysql:host=localhost;dbname=testdb;charset=utf8', 'username', 'password', array(PDO::ATTR_EMULATE_PREPARES => falsse, PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION));
    $stmt = $db->query("SELECT `user_id` FROM `users` WHERE `username` = '".$username."'"));
    $row_count = $stmt->rowCount();
    if($row_count==="1"){return true;}else{return false;}
}

answered Dec 6, 2013 at 21:12

Justin E

1,25016 silver badges30 bronze badges

2 Comments

Lorenz Over a year ago

That's wrong! If you count the rows with the MySQL COUNT() expression, it will return one row with the number of rows. Your code would always return true. You need to fetch the first line and then check the first column of that.

Justin E Over a year ago

I have updated my answer. It now locates the user that matches the username, and counts the amount of rows that were returned.

Collectives™ on Stack Overflow

php not getting user info from database

3 Answers 3

5 Comments

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

5 Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related