PHP SQL login error

Question

I'm trying to create a login page using php and sql. This is my php code that gets the username and password data from mysql and checks if they are right so the user gets logged in. I'm getting this error:

Call to a member function fetch() on a non-object

on the line:

$row = $result->fetch(PDO::FETCH_ASSOC);

Here is my code:

<?php session_start();

$db = new PDO("mysql:host=localhost;dbname=database","user","pass");
  if(mysqli_connect_errno())
  {
    echo "fail!". mysqli_connect_errnor();
  }

$first =$_POST['username'];
$last=$_POST['password'];

$sql="SELECT count(user_id) as records FROM table WHERE username='$first' AND password='$last'";
$result = $db->query($sql);
$row = $result->fetch(PDO::FETCH_ASSOC);
if ($row['records'] == 1);
{
    $_SESSION['loggedIN'] =true;
    header("Location:logged.php");
    die();

}
else {

    $_SESSION['loggedIN'] = null;
    header("Location:home.php");
    die();

}


?>

table is a reserved word,are you sure your table name is table?Use backticks if so `table`.Also google prepared statements. — Mihai
– Mihai, Commented Jan 14, 2014 at 15:39
So you're attempting to use PDO, but you're still placing $_POST data directly into the query? Nice... — Ryan
– Ryan, Commented Jan 14, 2014 at 15:39
You can't just assume your query worked, you need to check for errors before fetch()ing. if($result === FALSE){ var_dump($db->errorInfo()); die; }. P.S. PDO doesn't magically make your queries injection-free, you need to be using prepared statements. P.P.S. mysqli_connect_errno won't help you here. You're using PDO not MySQLi. — gen_Eric
– gen_Eric, Commented Jan 14, 2014 at 15:41
Apart from the sql injection problem and the table name, you are using PDO but checking for mysqli errors... — jeroen
– jeroen, Commented Jan 14, 2014 at 15:41

VolkerK · Accepted Answer · 2014-01-14 15:49:04Z

1

try it with

$db = new PDO("mysql:host=localhost;dbname=database","user","pass");
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$db->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);

makes it harder to miss errors that might occur.
And then as - Stanyer pointed out - don't put the parameters directly into your query but pass them as ..parameters.

$stmt = $db->prepare('SELECT count(user_id) as records FROM `table` WHERE username=? AND password=?');
$stmt->execute( array($_POST['username'], $_POST['password']) );
$row = $result->fetch(PDO::FETCH_ASSOC);

answered Jan 14, 2014 at 15:49

VolkerK

96.3k20 gold badges169 silver badges232 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

PHP SQL login error

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related