[Bestford]

hello guys i have this function and i keep getting an error on line 15(i have shown this in the code below)

Warning: mysql_fetch_assoc() expects parameter 1 to be resource, boolean given in C:\xampp\htdocs\lr\core\functions\users.php on line 12

i have provided the code for the function and the code it links to on another file
users.php

function user_data($user_id) {
	$data = array();
	$user_id = (int)$user_id;
	
	$func_num_args = func_num_args();
	$func_get_args = func_get_args();
	
	if ($func_num_args > 1) {
		unset($func_get_args[0]);
		$fields = '`' . implode('`,`', $func_get_args) . '`';
//error seems to be appearing on the line below with:(mysql_fetch_assoc)
		$data = mysql_fetch_assoc(mysql_query("SELECT $fields FROM `users` WHERE `user_id` = $user_id"));
		print_r($data);
		die();
		return $data;
	}
		
	
}

init.php

session_start();
//error_reporting(0);

require('database/connect.php');
require('functions/general.php');
require('functions/users.php');

if (logged_in() === TRUE) {
	$session_user_id = $_SESSION['user_id'];
	$user_data = user_data($session_user_id, 'user_id','username','password', 'firstname', 'lastname', 'email');


}

$errors = array();
?>

[RudiVisser]

It means your database query is failing, drag it out into separate steps and use mysql_error to get the actual error, like so:

$results = mysql_query("SELECT $fields from `users` WHERE `user_id` = $user_id");
if (!$results)
    die(mysql_error());
$data = mysql_fetch_assoc($results);

Be sure to use mysql_real_escape_string on all user-provided data given to a query ($user_id in your case).

Finally since somebody else will come along and put it here rather than actually helping - the mysql_ series of functions are deprecated and you should use MySQLi/PDO because you'd get a descriptive exception upon an error like this in the future and bla bla bla

This post has been edited by RudiVisser: 09 October 2012 - 07:14 AM

[Bestford]

thank you very much ive been working on this error for about two hours

Resolved

[RudiVisser]

No need to work on something for 2 hours like this again, read the documentation for mysql_query and then read the error again.

It says that mysql_fetch_assoc expects a resource, but it got a Boolean. In the documentation for mysql_query, you'll see that it returns a resource on success and Boolean false upon an error. Reading further into the documentation will tell you that mysql_error will get you the last error that happened whilst using PHP's MySQL API.

It's very simple to fix if you just think about what you're actually doing and the source of where things go wrong. If in doubt, split it out into separate method calls rather than chaining them together like I did in my example.

[Atli]

RudiVisser, on 09 October 2012 - 09:41 AM, said:

Be sure to use mysql_real_escape_string on all user-provided data given to a query ($user_id in your case) even if you're typecasting it.

That's not really necessary though. If you typecast it to an int, that eliminates any threat of SQL injection. Passing an integer through mysql_real_escape_string is pretty much just a wasted function call.

[CTphpnwb]

Of course, you shouldn't be using MySQL functions at all, including mysql_real_escape_string. You should be using PDO or MySQLi prepared statements, where calls to mysql_real_escape_string are completely unnecessary.

[JackOfAllTrades]

CTphpnwb, on 09 October 2012 - 08:31 AM, said:

Of course, you shouldn't be using MySQL functions at all, including mysql_real_escape_string. You should be using PDO or MySQLi prepared statements, where calls to mysql_real_escape_string are completely unnecessary.

This was covered by RudiVisser above:

Quote

Finally since somebody else will come along and put it here rather than actually helping - the mysql_ series of functions are deprecated and you should use MySQLi/PDO because you'd get a descriptive exception upon an error like this in the future and bla bla bla

[Bestford]

hey guys, i have this error:

Warning: mysql_result(): supplied argument is not a valid MySQL result resource in /var/www/vhosts/numyspace.co.uk/web_users/home/~unn_w10011815/public_html/lr/core/functions/users.php on line 27

and this is on the webhosting how ever it works on the localhost

can anyone help

<?php
function user_data($user_id) {
	$data = array();
	$user_id = (int)$user_id;

	$func_num_args = func_num_args();
	$func_get_args = func_get_args();

	if ($func_num_args > 1) {
		unset($func_get_args[0]);

		$fields = '`' . implode('`, `', $func_get_args) . '`';
		$results = mysql_query("SELECT $fields from `users` WHERE `user_id` = $user_id");
		if (!$results)
			die(mysql_error());
		$data = mysql_fetch_assoc($results);
		return $data;
	}
}

function logged_in(){
	return (isset($_SESSION['user_id'])) ? true : false;
}

function user_exists($username){
	$username = sanitize($username);
//error is on the line below this one
	return (mysql_result(mysql_query("SELECT COUNT(`user_id`) FROM `users` WHERE `username` = '$username'"), 0) == 1) ? true :false;
}

function user_active($username){
	$username = sanitize($username);
	return (mysql_result(mysql_query("SELECT COUNT(`user_id`) FROM `users` WHERE `username` = '$username' AND `active` = 1"), 0) == 1) ? true :false;
}

function user_id_from_username($username){
	$username = sanitize($username);
	return mysql_result(mysql_query("SELECT `user_id` FROM `users` WHERE `username` = '$username' "), 0, 'user_id');
}


function login($username, $password){
	$user_id = user_id_from_username($username);

	$username = sanitize($username);
	$password = md5($password);

	return (mysql_result(mysql_query("SELECT COUNT(`user_id`) FROM `users` WHERE `username` = '$username' AND `password` = '$password'"), 0)== 1) ? $user_id : false;
}

?>

[no2pencil]

Validate your variables :

$sql = "SELECT COUNT(`user_id`) FROM `users` WHERE `username` = '$username'";
$result = mysql_query($sql);
if(!$result) {
  echo "There was a error in the following sql statement : <br>".$sql;
}

Likely username is empty or is invalid. I've never seen an sql statement like you built, with three functions wrapped into one. You should also look into prepared statements. You'll get a detailed ear full from a few members here about using old technology. I just don't have the links like they do

[Sho Ke]

mysql_result's first parameter must be a resource, so that error means mysql_query isn't returning one.

The documentation for mysql_query says that it returns a resource on success, and boolean FALSE on failure, so your query is failing. Try executing that query directly through mySQL and see what it says.

[Dormilich]

your query might’ve failed. though that’s hard to untangle when you nest function calls that deep.

essentially, you need to debug that line. check each and every sub-call/sub-statement/variable, whether it is what you expect.

... do I need to urge the requirement for error checks?

no2pencil, on 09 October 2012 - 03:57 PM, said:

You'll get a detailed ear full from a few members here about using old technology. I just don't have the links like they do

me being the first, CT will certainly follow.

disclaimer: the mysql extension is outdated, use the modern PDO or MySQLi (i like improved) instead. those extensions also provide Prepared Statements which make SQL Injection impossible.

This post has been edited by Dormilich: 09 October 2012 - 07:10 AM

[RudiVisser]

Atli, on 09 October 2012 - 01:21 PM, said:

That's not really necessary though. If you typecast it to an int, that eliminates any threat of SQL injection. Passing an integer through mysql_real_escape_string is pretty much just a wasted function call.

Ah, I had meant it as a general catch-all, perhaps "even if you're typecasting it" was going a bit too far. I've seen people typecast to a string in the past and place it straight into queries even though it's the most pointless thing in the world

JackOfAllTrades, on 09 October 2012 - 02:17 PM, said:

This was covered by RudiVisser above:

At least I wasn't wrong

[Bestford]

this is what i have now

<?php
function user_data($user_id) {
	$data = array();
	$user_id = (int)$user_id;

	$func_num_args = func_num_args();
	$func_get_args = func_get_args();

	if ($func_num_args > 1) {
		unset($func_get_args[0]);

		$fields = '`' . implode('`, `', $func_get_args) . '`';
		$results = mysql_query("SELECT $fields from `users` WHERE `user_id` = $user_id");
		if (!$results)
			die(mysql_error());
		$data = mysql_fetch_assoc($results);
		return $data;
	}
}

function logged_in(){
	return (isset($_SESSION['user_id'])) ? true : false;
}

function user_exists($username){
	$username = sanitize($username);
	$sql = "SELECT COUNT(`user_id`) FROM `users` WHERE `username` = '$username'";
	$result = mysql_query($sql);
	if(!$result) {
		echo "There was a error in the following sql statement : <br>".$sql;
	}

}

function user_active($username){
	$username = sanitize($username);
	return (mysql_result(mysql_query("SELECT COUNT(`user_id`) FROM `users` WHERE `username` = '$username' AND `active` = 1"), 0) == 1) ? true :false;
}

function user_id_from_username($username){
	$username = sanitize($username);
	return mysql_result(mysql_query("SELECT `user_id` FROM `users` WHERE `username` = '$username' "), 0, 'user_id');
}


function login($username, $password){
	$user_id = user_id_from_username($username);

	$username = sanitize($username);
	$password = md5($password);

	return (mysql_result(mysql_query("SELECT COUNT(`user_id`) FROM `users` WHERE `username` = '$username' AND `password` = '$password'"), 0)== 1) ? $user_id : false;
}

?>

and the errors i have are :

There was a error in the following sql statement :
SELECT COUNT(`user_id`) FROM `users` WHERE `username` = 'mark'
Warning: mysql_result(): supplied argument is not a valid MySQL result resource in /var/www/vhosts/numyspace.co.uk/web_users/home/~unn_w10011815/public_html/lr/core/functions/users.php on line 37

[Dormilich]

do all those fields exist in that table?

[Bestford]

fixed it thanks guys