Hello everyone. I have really screwed up this code and can't seem to figure out all the things that is wrong with it. Can someone point me in the right direction?

Thanks!
~Amy

<?php
/*	Program name: listings.php
 *	Description: This will pull some of the customer's information
 * 		out of the database and display it in a table as a
 *		link to get further information on customer's
 *		property.  Pagination.
 */

include ("mydatabaseinfo.txt");

$cxn = mysqli_connect ($host, $user, $password, $database) 
	or die ("No Connection");

//Number of records to show per page:
$display=50;

//Determine how many pages there are...
if(isset($_GET['p']) && is_numeric($_GET['p']))
{//Already been determined.
$pages=$_GET['p'];
}
else{//Need to determine.
//Count the number of records:
$county=$_GET ['county_name'];
$state=$_GET ['state'];
$q='SELECT COUNT(*) FROM Property WHERE  
county=? AND state=?';
$stmt=mysqli_prepare($cxn, $q);
mysqli_stmt_bind_param($stmt,'ss', $c, $s);
$c='$county'; 
$s='$state';
mysqli_stmt_execute($stmt);
//Check the results:
if (mysqli_stmt_affected_rows($stmt) ==1)
{}
else { echo 'A system error occurred1';}

//Close the statement:
mysqli_stmt_close($stmt);

$row=@mysqli_fetch_array ($result, MYSQLI_NUM);
$records=$row[0];

//Calculate the number of pages...
if ($records > $display) //More than 1 page.
{
$pages=ceil ($records/$display);
}else{
$pages=1;
}
}//End of p IF.

//Determine where in the database to start returning results...
if (isset($_GET['s']) && is_numeric($_GET['s'])){
$start=$_GET['s'];
} else {
$start=0;
}

//Determine the sort...

//Default is by highest price to lowest price
$sort=(isset($_GET['sort'])) ? $_GET['sort'] : 'pr';

//Determine the sorting order:
switch ($sort) {

case 'prhl':
	$order_by = 'price ASC';
break;

case 'prlh':
	$order_by = 'price DESC';
break;

default:
	$order_by ='price DESC';
break;
}


//Make the query:

$q='SELECT ID, Type, street, city, price, sqft FROM Homes, About Home WHERE county=? AND state=? AND active=1 ORDER BY $order_by';
$r= @mysqli_query ($cxn, $q);
    $stmt=mysqli_prepare($cxn, $q);
mysqli_stmt_bind_param($stmt, 'ss', $c, $s);
$c='$county';
$s='$state';
mysqli_stmt_execute($stmt);
//Check the results:
if (mysqli_stmt_affected_rows($stmt) ==1)
{}
else { echo 'No results found!';}

$ID="ID";
$Type="Type";
$street="street";
$city="city";
$sqft="sqft";
$price="price";

//Table Header
echo "<table align=center border=1>\n";
echo "<tbody>\n";
echo "<tr><th bgColor=#add8e6>ID#</th>\n";
echo "<th bgColor=#add8e6>Type</th>\n";
echo "<th bgColor=#add8e6>Address</th>\n";
echo "<th bgColor=#add8e6>City</th>\n";
echo "<th bgColor=#add8e6>Sq Ft</th>\n";
echo "<th bgColor=#add8e6>Price</th>\n";
echo "</tr>\n";

//Fetch and print all the records...

$bg='#add8e6';//Set the initial background color
while ($row=mysqli_fetch_array($r, MYSQLI_ASSOC)){
$bg=($bg=='#add8e6' ? '#ffffff' : '#add8e6');//Switch the background color.

echo "<tr bgcolor=\"' . $bg . '\">\n";
echo "<td align=middle><a href=\"Your Place.php?ID=$ID\">$ID</a></td>\n";
echo "<td align=middle>$Type</td>\n";
echo "<td align=middle><a href=\"Your Place.php?street=$street\">$street</a></td>\n";
echo "<td align=middle>$city</td>\n";
echo "<td align=middle>$sqft</td>\n";
echo "<td align=middle><a href=\"listings.php?sort=prhl\">$price</a></td>\n";
echo "</tr>\n";

}//End of WHILE loop.

echo '<table>';
mysqli_free_result ($r);

//Make links to other pages if necessary.
if ($pages>1){

//Add some space & start a paragraph.
echo '<br /?<p>';

//Determine what page the script is on:
$current_page = ($start/$display) + 1;

//If it's not the first page, make a previous button:
if ($current_page != 1) {
echo '<a href="listings.php?s=' . ($start - $display) . '&p=' . $pages . '&sort=' . $sort . '">Previous</a> ';
}

//Make all the numbered pages:

for ($i=1; $i<=$pages; $i++) {
if($i !=$current_page) {
echo '<a href="listings.php?s=' . (($display * ($i - 1))) . '&p=' . $pages . '&sort=' . $sort . '">' . $i . '</a> ';
} else {
echo $i . ' ';
}
} //End of FOR loop.

//If it's not the last page, make a next button.
if ($current_page !=$pages) {
echo '<a href="listings.php?s=' . ($start + $display) . '&p=' . $pages . '&sort=' . $sort . '">Next</a>';
}
echo '</p>';//Close paragraph.

}//End of links section.

?>

Dani AI

Generated

Brief summary and next steps

As discovered, the immediate problem was environmental: the mysqli extension requires PHP 5+. If the server is still PHP4 the mysqli calls will fail (mysqliprepare returns false) and every subsequent mysqli* call generates the warnings you saw. As also noted, there are some string/quoting mistakes in the HTML output that will break the page even after the DB errors are fixed.

Quick checklist to get a working baseline

  • Confirm PHP version (phpinfo() or php -v) and whether mysqli_connect exists (function_exists('mysqli_connect')).
  • Turn on full errors while debugging: error_reporting(E_ALL); ini_set('display_errors',1);
  • Always check return values from mysqli_prepare / mysqli_query and call mysqli_error($cxn) when something fails.

Safer prepared-statement pattern (compact example)

$sql = "SELECT COUNT(*) FROM Property WHERE county=? AND state=?";
$stmt = mysqli_prepare($cxn, $sql);
if (!$stmt) { die('Prepare failed: ' . mysqli_error($cxn)); }
mysqli_stmt_bind_param($stmt, 'ss', $county, $state);
mysqli_stmt_execute($stmt);
mysqli_stmt_bind_result($stmt, $count);
mysqli_stmt_fetch($stmt);
mysqli_stmt_close($stmt);

Notes on common logic bugs and fixes

  • For SELECTs, don’t use mysqli_stmt_affected_rows; for a COUNT(*) bind the result and fetch, or call mysqli_stmt_store_result() + mysqli_stmt_num_rows() where appropriate.
  • When building ORDER BY, whitelist allowed column/direction values and then append the validated string to the SQL (never inject raw $_GET).
  • Don’t set variables to literal column-name strings and echo those; inside the fetch loop use the fetched row values (e.g., $row['ID']) and apply htmlspecialchars() before output.
  • Avoid spaces in table names (rename or use backticks), use explicit JOIN syntax instead of comma joins, and fix the broken HTML/quoting (as pointed out) and the incorrect </table> echo at the end.

If upgrading PHP is not immediately possible the short-term fallback is to rewrite the script using the older mysql_* API that exists on PHP4, but that is only a temporary measure — upgrading to a maintained PHP version and using mysqli or PDO is the correct long-term fix.

Recommended Answers

All 6 Replies

This is the first thing I've spotted (as you can see, the whole things inside the quotes):

echo "<tr bgcolor=\"' . $bg . '\">\n";

this will echo: <tr bgcolor="' . #ffffff . '">\n (where #ffffff is the contents of $bg)

What you want is:

echo "<tr bgcolor='" . $bg . "'>\n";

You've also got a few ?'s in there instead of >'s too. Do a search (ctrl + F style) through the file.
Such as here:

//Add some space & start a paragraph.
echo '<br /?<p>';

It looks like a careful read through it should net you most of the problems.

Thank you, I changed those few things and then ran the program through localhost and this is what it came up with....

Warning: mysqli_stmt_bind_param() expects parameter 1 to be mysqli_stmt, boolean given on line 29

Warning: mysqli_stmt_execute() expects parameter 1 to be mysqli_stmt, boolean given on line 32

Warning: mysqli_stmt_affected_rows() expects parameter 1 to be mysqli_stmt, boolean given on line 34
A system error occurred
Warning: mysqli_stmt_close() expects parameter 1 to be mysqli_stmt, boolean given on line 39

Warning: mysqli_stmt_bind_param() expects parameter 1 to be mysqli_stmt, boolean given on line 87

Warning: mysqli_stmt_execute() expects parameter 1 to be mysqli_stmt, boolean given on line 90

Warning: mysqli_stmt_affected_rows() expects parameter 1 to be mysqli_stmt, boolean given on line 92
No results found!ID# Type Address City Sq Ft Price 

Warning: mysqli_fetch_array() expects parameter 1 to be mysqli_result, boolean given on line 117
 
Warning: mysqli_free_result() expects parameter 1 to be mysqli_result, boolean given on line 132

Okay, sorry, I revised it and now let me break the errors down:

Warning: mysqli_stmt_bind_param() expects parameter 1 to be mysqli_stmt, boolean given on line 29
That is for this line:

mysqli_stmt_bind_param($stmt,'ss', $c, $s);

Warning: mysqli_stmt_execute() expects parameter 1 to be mysqli_stmt, boolean given on line 32
That is for this line:

mysqli_stmt_execute($stmt);

Warning: mysqli_stmt_close() expects parameter 1 to be mysqli_stmt, boolean given on line 35
That is for this line:

mysqli_stmt_close($stmt);

Warning: mysqli_stmt_bind_param() expects parameter 1 to be mysqli_stmt, boolean given on line 86
That is for this line:

mysqli_stmt_bind_param($stmt, 'ss', $c, $s);

Warning: mysqli_stmt_execute() expects parameter 1 to be mysqli_stmt, boolean given on line 89
That is for this line:

mysqli_stmt_execute($stmt);

Warning: mysqli_fetch_assoc() expects parameter 1 to be mysqli_result, boolean given on line 112
That is for this line:

while ($row=mysqli_fetch_assoc($r)){

Warning: mysqli_free_result() expects parameter 1 to be mysqli_result, boolean given on line 126
That is for this line:

mysqli_free_result ($r);

I can't figure out what in the world I'm doing wrong. Any ideas would be much appreciated!
Thanks!
~Amy

Please, any help offered will be much appreciated :)
~Amy

Please, any help offered will be much appreciated :)
~Amy

Sorry, I'm not familiar with that method of MySql interaction. It looks to me like there's something going wrong near the start (maybe with $stmt=mysqli_prepare($cxn, $q); or even before?) that means that nothing that follows can be executed properly.

You'll have to get someone else onto it.

PS editing your initial post so that your code is inside tags might be helpful.[code=php] tags might be helpful.

Okay, want to hear something very sad? I thought my server had a higher version of php...it has php4! mysqli won't work on php4! Geez!
Thanks anyway,
~Amy

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.