Member Avatar for NA

hi everyone i need help in my query while user login.

<?php

$username = $_POST["username"];
$password = $_POST["password"];

$con = oci_connect("user","pswrd","db");
if(! $con)
{
    die('Connection Failed'.oci_error());
}
$query = "SELECT username, password FROM users
WHERE username=$username";

$stmt = oci_parse($conn, $query);

$row = oci_fetch_array($stmt, OCI_NUM);;

if($row["username"]==$username && $row["password"]==$password)
    echo"You are a validated user.";
else
    echo"Sorry, your credentials are not valid, Please try again.";
?>

i got error which is that
oci_fetch_array(): ORA-24374: define not done before fetch or execute

  • 2 Contributors
  • 5 Replies
  • 598 Views
  • 2 Hours Discussion Span
  • Latest Post Latest Post by rproffitt

Dani AI

Generated

Quick diagnosis and immediate fixes (short): the Oracle error ORA-24374 ("define not done before fetch or execute") means the driver expected output variables to be defined before a fetch; common immediate causes are that the statement was never executed or parsing failed because the connection/statement handle was wrong (for example a $con vs $conn typo). was correct to call out the missing execute; also confirm that oci_parse returned a valid statement handle before fetching. See Oracle’s ORA-24374 explanation and the PHP OCI8 docs for execute/parse for details. (docs.oracle.com)

Use a safe, bind-and-verify pattern rather than string interpolation and plaintext passwords. A minimal secure flow: parse the statement, bind the username with oci_bind_by_name, execute the statement, fetch the row, then verify the stored hash with password_verify (store hashes created with password_hash when users register). The code below illustrates the flow (field name here is password_hash, do not store raw passwords):

<?php
$conn = oci_connect('DBUSER','DBPASS','DB');
if (!$conn) { $e = oci_error(); trigger_error(htmlentities($e['message']), E_USER_ERROR); }

$sql = 'SELECT username, password_hash FROM users WHERE username = :u';
$stid = oci_parse($conn, $sql);
oci_bind_by_name($stid, ':u', $username, 100);
oci_execute($stid);

$row = oci_fetch_array($stid, OCI_ASSOC+OCI_RETURN_NULLS);
if ($row && password_verify($password, $row['PASSWORD_HASH'])) {
    // authenticated
} else {
    // no match
}
oci_free_statement($stid);
oci_close($conn);
?>

Use parameter binding (see the PHP OCI bind docs) and PHP’s password_hash/password_verify for storage/verification; these APIs handle salts and algorithm metadata. (php.net)

Troubleshooting checklist: check for typos in variable names ($con vs $conn), verify oci_parse() returned a handle, call oci_execute() before any fetch, and inspect errors with oci_error() on the connection or statement handle to see parse/execute messages rather than guessing. Also avoid printing full DB errors in production logs. Example error-checking patterns are documented on the OCI8 manual. (php.net)

References: Oracle ORA-24374 explanation — oci_execute manual — oci_parse manual — oci_bind_by_name — password_hash/password_verify (see docs linked).

Recommended Answers

All 5 Replies

Member Avatar for NA

kindly guide me in my code why its not working?

Edited by NA
Member Avatar for NA

no sir explain in which line i need to change to a perfect code

Member Avatar for rproffitt

Sorry, I've yet to see perfect code. But I did try to share why your system is broken in both a missing line plus why it's a bad idea to store passwords.

I can only guess you didn't check the example in the PHP document link I shared.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.