Member Avatar for gikonyo

am geting this error while testing the login panel of my website that am currently developing.
Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/smartie1/public_html/checklog.php on line 43 which is in red

this is the php script used for login

<?php
 session_start(); 
 function session_defaults() {
$_SESSION['logged'] = false;
$_SESSION['uid'] = 0;
$_SESSION['username'] = '';
$_SESSION['cookie'] = 0;
$_SESSION['remember'] = false;
}

if (!isset($_SESSION['uid']) ) {
session_defaults();
}

$host="localhost"; // Host name
$username="root"; // Mysql username
$password=""; // Mysql password
$db_name="XXXXXX[CODE][/CODE]"; // Database name
$tbl_name="Customer_Infor"; // Table name
// Connect to server and select databse.
$con = mysql_connect("localhost","XXXXXX","YYYYY");
if (!$con)
{ 
die ('could not connect: '.mysql_error());
}

mysql_select_db("XXXXXX", $con)
or die("cannot select DB");
// username and password sent from form
$username=$_POST['username'];
$password=$_POST['password'];
// To protect MySQL injection (more detail about MySQL injection)
$username = stripslashes($username);
$password = stripslashes($password);
$username = mysql_real_escape_string($username);
$password = mysql_real_escape_string($password);

$sql="SELECT username,password FROM Customer_Infor WHERE username='$username' and
password='$password'";

$result=mysql_query($sql);
// Mysql_num_row is counting table row
[COLOR="Red"]$count=mysql_num_rows($result);[/COLOR]
// If result matched $email and $password, table row must be 1 row

if($count==1){
// Register $myusername, $mypassword and redirect to file "login_success.php"
session_register("username");
session_register("password");
//header("location:loginRedirect.php");
echo"welcome";
}
else {
echo "Wrong Username or Password";
//header("location:Wronglogin.html");
}
?>
Edited by Nick Evan because: Fixed formatting
  • 3 Contributors
  • 4 Replies
  • 319 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by gikonyo

Dani AI

Generated

— that red warning means mysql_num_rows() was given something other than a valid result resource. In practice that happens when mysql_query() fails (syntax error, wrong table name, wrong database or credentials, etc.) and returns false instead of a result. Showing the MySQL error (what suggested) is the right first step because it reveals the actual SQL/connection error. See the PHP docs for mysql_query() and mysql_num_rows() for details. (php.net)

Quick checklist to debug this reliably: confirm the connection succeeded and the correct DB was selected; echo the built SQL and run it directly in the MySQL client; watch for table/column name spelling and case (filesystems can make names case-sensitive); verify the query is a SELECT (non-SELECT queries will not return a result resource); and if $result === false print the error string from mysql_error() to see the exact MySQL message. Those checks will usually point to the precise cause. (php.net)

Longer term, migrate off the old mysql_* API: it was deprecated and removed from modern PHP — move to MySQLi or PDO and use prepared statements to avoid SQL injection, and use password_hash() / password_verify() instead of storing plaintext passwords. Also stop using session_register() (use $_SESSION[...]). A minimal login pattern using MySQLi + prepared statements + password_verify() looks like this:

$mysqli = new mysqli('127.0.0.1','dbuser','dbpass','dbname');
$stmt = $mysqli->prepare('SELECT id, password_hash FROM Customer_Infor WHERE username = ?');
$stmt->bind_param('s', $username);
$stmt->execute();
$stmt->bind_result($id, $hash);
if ($stmt->fetch() && password_verify($password, $hash)) {
  $_SESSION['uid'] = $id;
  $_SESSION['username'] = $username;
  // logged in
} else {
  // invalid login
}
$stmt->close();

Migrating fixes security and compatibility problems you’ll hit on modern PHP versions and also avoids the class of runtime warnings you saw. (php.net)

Additional note: ’s quick check about the table name was useful — a misspelled or case-mismatched table name is one of the most common causes of the exact warning you saw.

Recommended Answers

All 4 Replies

Member Avatar for pritaeas

That means your query failed. Try:

$result = mysql_query($sql) or die(mysql_error());
Member Avatar for smantscheff

Is Customer_Infor a spelling error?

Member Avatar for gikonyo

customer_infor is the table name where the username and password are stored

Member Avatar for gikonyo

thank you pritaeas, it has worked.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.