Mysqli_fetch_row error

2

I am learning PHP and I have been stuck here, the error is as follows:

  

Warning: mysqli_fetch_row () expects parameter 1 to be mysqli_result, boolean given in C: \ xampp \ htdocs \ intranet \ scripts \ functions.php on line 29

And here I leave my function:

function validarLogin($usuario, $clave){

    global $conexion;
    $consulta = "SELECT * FROM usuarios WHERE usuario = '".$usuario."''  AND clave = '".$clave."'";
    $respuesta= mysqli_query($conexion, $consulta);

if ($fila = mysqli_fetch_row($respuesta) ) {
        session_start();
        $_SESSION['usuario'] = $usuario;
        return true;
    }
    return false;


 }

Good afternoon, thanks for the feedback, the error is solved, now I have this script that serves as a bridge to access the user panel, I enter the correct username and password, and even tells me that they are incorrect, in addition to show blank page

       alert ('The data entered is incorrect')     location.href="../ index.php";           
asked by Anderson Quintero 02.07.2017 в 20:31
source

2 answers

3

What is telling you the error is that the mysqli_fetch_row() method waits for minus 1 result to be able to go through , but what is returning $respuesta is false , since the query does not return any records .

To foresee this it is better to use a syntax like the following:

function validarLogin($usuario, $clave){

        global $conexion;
        $consulta = "SELECT * FROM usuarios WHERE usuario = '".$usuario."''  AND clave = '".$clave."'";
         if ($respuesta= mysqli_query($conexion, $consulta)) {
            while ($fila = mysqli_fetch_row($respuesta)) {
               session_start();
               $_SESSION['usuario'] = $usuario;
               return true;
            }
         mysqli_free_result($resultado);
         } else {
         return false;
        }
}

Where the first if is conditioning if the result of the query is true will continue with mysqli_fetch_row and otherwise return false;

Clarification Important:

If you are using this feature to validate the entered data in login , what you are having is serious code injection risks >, using the variable $consulta to store the SQL query by concatenating the search parameters .

  

You can read more about SQL Injection: PHP: SQL Injection , SOes Response on SQL Injection

You can prevent this by modifying the code to use prepared-statement and parameters .

function validarLogin($usuario, $clave){

        global $conexion;
        $stmt = $dbConnection->prepare('SELECT * FROM usuarios WHERE usuario = ? AND clave = ?');
        $stmt->bind_param('ss', $usuario, $clave);

        $stmt->execute();

        if ($result = $stmt->get_result()) {         
            while ($row = $result->fetch_assoc()) {
                session_start();
                $_SESSION['usuario'] = $usuario;
                return true;
            }
        } else {
            return false;
        }
}
    
answered by 02.07.2017 / 21:15
source
0

The error you receive is this:

  

Warning: mysqli_fetch_row () expects parameter 1 to be mysqli_result, boolean given in C: \ xampp \ htdocs \ intranet \ scripts \ functions.php on line 29

Which means that the first parameter that you pass to mysqli_fetch_row is incorrect because it should be a mysqli_result but it is really a boolean (and FALSE to be more specific although the error does not say it).

This error occurs because the $respuesta (the result of mysqli_query ) is a Boolean value. This occurs because the response of mysqli_query was FALSE, which is specified in the PHP documentation only It happens when there is an error:

  

[mysqli :: query - mysqli_query] Returns FALSE in case of error. If a query of type SELECT, SHOW, DESCRIBE or EXPLAIN is successful, mysqli_query () will return a mysqli_result object. For other successful mysqli_query () queries, you will return TRUE.

This indicates that there is an error in the query that you made (eg a syntax error or incorrect table / column names). In particular, and as D.Bulten says in his comment , the problem is that the quotes are wrong in the query:

"SELECT * FROM usuarios WHERE usuario = '".$usuario."''  AND clave = '".$clave."'"
                                                      ^ esta comilla está de más

It should be this way:

"SELECT * FROM usuarios WHERE usuario = '".$usuario."'  AND clave = '".$clave."'"

Also, as Agustin M. indicates in your answer , you should use more secure methods when it comes to perform queries in the database: parameterized queries instead of concatenation of strings that can cause errors (for example, if the username contains a single quote) and serious security problems (such as SQL injection).

    
answered by 27.12.2017 в 14:07