Member Avatar for niths

hai i am new to php. i am getting this as error

---You have an error in your SQL syntax; check the manual that corresponds to your MySQL---
can anyone tel wher is the error. Thank u..!!

<html>
<body>
<form action="login.php" method="post">
<div>
<table width="100%">
    <tr>
        <td><img src="Logofinalcopy.gif"></td>
    </tr>
    <tr>
        <td bgcolor="aqua"><h2>Login</h2></td>
    </tr></table>
<table align="right" style="width:40%">
    <br>
    <tr>
       <td>Username:</td>
       <td><input type="text" name="username"></td>
    </tr>
    <tr>
       <td>Password:</td>
       <td><input type="password" name="password"></td>
    </tr>
    <tr>
        <td align="CENTER" COLSPAN="4">
        <input TYPE="SUBMIT" name="submit" value="Login">
        <input TYPE="reset" name="submit" value="clear"></td>
    </tr>
</table>
</div>
</form>
</body>
</html>
<?php
if(isset($_POST['submit']))
{
    $con = mysql_connect("10.70.1.50","invensis","invensis");
    if (!$con)
    {
        die('Could not connect: ' . mysql_error());
    }
    $con=mysql_select_db("database_myproject");
    if (!$con)
    {
        die('Could not connect DB: ' . mysql_error());
    }

    $username=$_POST['username'];
    $password=$_POST['password'];
    $Username = stripslashes($username);
    $Password = stripslashes($password);
    $Username = mysql_real_escape_string($username);
    $Password = mysql_real_escape_string($password);
    $flag="OK";  
    $msg=""; 
    if(strlen($Username) < 1)
    {
        $msg=$msg."Please enter the username<br>";
        $flag="NOTOK"; 
    }
    if(strlen($Password) < 1)
    {
        $msg=$msg."Please enter the password<br>";
        $flag="NOTOK";  
    }
    if($flag <>"OK")
    {
       echo "<br><br><br><br><br><strong style='color:#FF3333'>"."<right>Please enter Username/Password <br></right>"."</strong>";                                                                                                                                }  
    else
    {
        $sql="SELECT * FROM Users WHERE Username='$Username' and Password='$Password'";        
        $result=mysql_query($sql) or die(mysql_error()); 
        $count=mysql_num_rows($result);          
        if($count==1)
        {                    
            $sql1 =mysql_query("SELECT Role FROM Users WHERE Username='$Username' and Password='$Password'");
            while($info = mysql_fetch_array($sql1))
            $info['Role'];   
            {
                if($info['Role']== '0')
                {
                    @header("location: http://localhost//Project/Superadmin.php");
                } 
                else if($info['Role']== '1')
                {
                    @header("location: http://localhost//Project/Admin.php");
                } 
                else if($info['Role']== '2')
                {
                    @header("location: http://localhost//Project/User.php");
                } 
            }   

        }
        else 
        {
            echo "<br><br><br><br><br><strong style='color:#FF3333'><left>Incorrect UserName OR Password</left></strong>";
        }

    }
}
?>
Edited by Reverend Jim because: Fixed formatting
  • 2 Contributors
  • 4 Replies
  • 119 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by hashinclude

Dani AI

Generated

The MySQL message that ends with "near 'Resource id #30' at line 1" means the database received the literal text "Resource id #N" as the query. That string appears when a PHP resource (for example a mysql result handle) is treated as a string. Common causes are passing a result/resource to mysql_query() by mistake, concatenating a resource into a SQL string, or reusing a variable name for both a SQL string and a result handle.

In the posted code (as noted by ), several result handles are created and variable reuse is visible. The failing query might be in the login flow or in the redirected pages (Superadmin/Admin/User). Examine places where mysql_query() is called and confirm the argument is a string. Also look for a stray semicolon after a while(...) or similar logic errors that leave variables unset or hold unexpected values.

Useful, immediate debugging steps:

// Before executing a query, reveal what will be run
var_dump($queryString);               // must show a string
error_log('SQL: ' . $queryString);

// Check suspicious variables for being resources
var_dump(is_resource($maybeVar));
if (is_resource($maybeVar)) {
    error_log('Resource type: ' . get_resource_type($maybeVar));
}

Practical fixes: ensure mysql_query() always receives a SQL string; fetch role/row with a single mysql_fetch_assoc() call and use its values directly; do not put HTML inside header() — use a Location header and exit;. For long term safety, migrate off the deprecated mysql_* extension to mysqli or PDO and use prepared statements. References: mysql_query manual, get_resource_type, and header.

Recommended Answers

All 4 Replies

Member Avatar for hashinclude

both queries seem fine to me, can you post the entire error message?

Member Avatar for niths

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Resource id #30' at line 1

Member Avatar for niths

both queries seem fine to me, can you post the entire error message?

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Resource id #30' at line 1

Member Avatar for hashinclude

when do you get this error?
the query causing the error is not in the code you posted, perhaps it's in one of those files "superadmin.php", "admin.php", "user.php"

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.