Member Avatar for dylank

Hello DaniWeb Community! I am trying to create a web page that utilizes Ajax and PHP to connect to my mySql database and look up a username and password. You have all most likely seen the web page that has the template code on it: http://www.phpeasystep.com/workshopview.php?id=6
This code is nice as a template, but I cannot get one of the functions to work: mysql_num_rows($result); . I get this message: Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/thatcom1/public_html/drafts/HaxMe/DatabaseAjaxLogin/processLogin.php on line 31 . I have looked it over, there is nothing wrong with that perticular line of code or any others around it. the source for my page is:

processLogin.php:

<?php
//processLogin.php
//Will return welcome message if login is correct, incorrect message if incorrect and set a cookie. 
?>
<html>
<body>
<?php
$host="localhost"; // Host name
$username="blablabla"; // Mysql username
$password="blablabla"; // Mysql password
$db_name="blablabla"; // Database name
$tbl_name="users"; // Table name

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");

// username and password sent from form
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];

// To protect MySQL injection. I took this out for debugging. 
/*$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);
*/
$sql="SELECT * FROM 'users' WHERE userName='$myusername' and passHash=md5('$mypassword')";
$result=mysql_query($sql);
// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
echo "count is: ";
echo $count;
// If result matched $myusername and $mypassword, table row must be 1 row
mysql_close();
if($count==1){
echo "<font color=\"green\">Correct Password!</font>";
}
else {
echo "<font color=\"red\">Incorrect! $mypassword </font>";
}

?>
</body>
</html>

This is part of an Ajax login page, the site that is running this code can be found here:

If you need the ajax page, tell me.
again, that is my webpage if you need to use it for testing.

  • 2 Contributors
  • 1 Reply
  • 4K Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by mwasif

Dani AI

Generated

Good catch by : the error means mysql_query() returned false, so mysql_num_rows() is being given an invalid resource. In your SQL, single quotes create string literals, not identifiers, so quoting the table breaks the query. Add proper error checking so you see the real MySQL message while you debug.

$result = mysql_query($sql);
if ($result === false) {
    die('Query failed: '.mysql_error().' SQL: '.$sql);
}
$count = mysql_num_rows($result);

A couple of practical tweaks for your login check:

  • Re-enable escaping you commented out. Without it, you are vulnerable to SQL injection.
  • Ask MySQL to do less work. You only need to know if one row exists, so use COUNT(*) and LIMIT 1, and ensure userName is indexed.
$u = mysql_real_escape_string($myusername);
$p = mysql_real_escape_string($mypassword);
$sql = "SELECT COUNT(*) AS n
        FROM users
        WHERE userName = '$u' AND passHash = MD5('$p')
        LIMIT 1";
$res = mysql_query($sql) or die(mysql_error());
$row = mysql_fetch_assoc($res);
if ((int)$row['n'] === 1) {
    echo 'Correct Password!';
} else {
    echo 'Incorrect!';
}

Longer term, consider two upgrades so you do not hit similar issues again:

  • Move from the old mysql_* API to mysqli or PDO with prepared statements. That eliminates manual escaping and gives clearer error handling.
  • Replace MD5 with password_hash() / password_verify(). If you already have MD5 hashes, you can verify them in PHP during login and migrate users to a modern hash the next time they successfully sign in.
Member Avatar for mwasif

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result

It means query did not execute successfully.

You are using single quotes around table name which is not correct. Either use back tick ` around the table name or don't use anything at all e.g.

$sql="SELECT * FROM `users` WHERE userName='$myusername' and passHash=md5('$mypassword')";

OR

$sql="SELECT * FROM users WHERE userName='$myusername' and passHash=md5('$mypassword')";
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.