MySQL error when getting variable from URL

Question

This is the code I have, but I get this error when I try to get variable from the url: Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource

The URL variable DEVID is a long string of characters, numbers, dashes, and underscores. Any ideas on what is wrong?

<?php
$con = mysql_connect("server","username","password");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("database", $con);

$result = mysql_query("SELECT * FROM $user WHERE DEVID=$DEVID");


while($row = mysql_fetch_array($result))
  {
  if (($row["FN"]) == NULL){
echo '<meta http-equiv="refresh" content="1;url=../register/default.php?user=';
echo $_GET["user"];
echo '&DEVID=';
echo $_GET["DEVID"];
echo '">Please hold, we are taking you to the registration page.<br/><br/>';
}

  }


mysql_close($con);
?>

echo mysql_error(); right after your mysql_query and google about sql injections. PS: any reason to show user please hold page instead of immediate redirect? — zerkms
– zerkms, Commented Jan 8, 2012 at 4:46
Is this your full code? If it is, I don't see any variables named $user or $DEVID. If by $user you meant a table named user, then remove the $ sign, and add another check just before the while loop - if ($result)....... — MD Sayem Ahmed
– MD Sayem Ahmed, Commented Jan 8, 2012 at 4:46
the variables are in the URL... They come to the page with the URL formatted like default.php?user=name&DEVID=m0mvtRLb3Mm9c8ZlKa8_S2J5L-J35caA7eqQHb_DQ1a4pbOMmag0Mrt_Nz72VH48PQcMmt44Yxaic_NRXQqW-b3nSGgs3VLBp21Ii942DaZIhW0PqNi1wERne1jT7to30 — austinh
– austinh, Commented Jan 8, 2012 at 4:53
Do you GET[] them from the URL in some other piece of code? You need to do that before you use them, I believe. Like this: $user = GET['user']; And this is a SQL injection waiting to happen... I'd make sure to scrub the variables at least. — Justin
– Justin, Commented Jan 8, 2012 at 4:54

davidethell · Accepted Answer · 2012-01-08 04:53:48Z

1

If $DEVID is a VARCHAR field then you'll need single quotes around it in your SQL query:

SELECT * FROM $user WHERE DEVID='$DEVID'

answered Jan 8, 2012 at 4:53

davidethell

12.1k6 gold badges47 silver badges67 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Jonathon Reinhart · Accepted Answer · 2012-01-08 04:49:47Z

0

Where is $DEVID being set before the query? You're not using PHP register_globals, and that's coming from a query-string variable are you? This is 2012! When are people going to stop using that?

answered Jan 8, 2012 at 4:49

Jonathon Reinhart

138k38 gold badges266 silver badges347 bronze badges

Comments

Ghost-Man · Accepted Answer · 2012-01-08 04:58:35Z

0

Do the variables $user and $DEVID has values? Have they been initialized ?

Assuming that $user and $DEVID has been initailized the error is happening because mysql_query is returning false as the SQL query generates error when executed.

Moreover you should not use variables directly obtained from the URL. Clean the value for possible presence of single qoutes. Use mysql_real_esacape_string(). Replace the mysql_query line with the below to see the SQL error if it occurs.

$DEVID=mysql_real_escape_string($DEVID);
$result = mysql_query("SELECT * FROM $user WHERE DEVID='$DEVID'") or die(mysql_error());

answered Jan 8, 2012 at 4:58

Ghost-Man

2,1951 gold badge21 silver badges25 bronze badges

Collectives™ on Stack Overflow

MySQL error when getting variable from URL

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related