Member Avatar for niths

---Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in C:\Program Files\Apache Group\Apache2\htdocs\Project\login.php on line 72----

<html>
<body>
<form action="login.php" method="post">
<div>
<table width="100%">
<tr>
<td><img src="Logofinalcopy.gif"></td>
</tr>
<tr>
<td bgcolor="aqua"><h2>Login</h2></td>
</tr></table>
<table align="right" style="width:40%">
<br>
<tr>
<td>Username:</td>
<td><input type="text" name="username"></td>
</tr>
<tr>
<td>Password:</td>
<td><input type="password" name="password"></td>
</tr>
<tr>
<td align="CENTER" COLSPAN="4">
<input TYPE="SUBMIT" name="submit" value="Login">
<input TYPE="reset" name="submit" value="clear"></td>
</tr>
</table>
</div>
</form>
</body>
</html>
<?php
if(isset($_POST['submit']))
{
    $username=$_POST['username'];
    $password=$_POST['password'];
    $Username = stripslashes($username);
    $Password = stripslashes($password);
    $Username = mysql_real_escape_string($username);
    $Password = mysql_real_escape_string($password);

    if(strlen($Username) < 1)
    {
        $msg=$msg."Please enter the username<br>";
        $flag="NOTOK";
    }
    else if(strlen($Password) < 1)
    {
        $msg=$msg."Please enter the password<br>";
        $flag="NOTOK";
    }
    else
    {
        $flag="OK";
        $msg="";
    }



    if($flag != "OK")
    {
        echo "<br><br><br><br><br><strong style='color:#FF3333'>"."<right>Please enter Username/Password <br></right>"."</strong>";
    }
    else
    {
        $con = mysql_connect("10.70.1.50","invensis","invensis", true) or die('Could not connect: ' . mysql_error());                
        mysql_select_db("database_myproject", $con)or die('Could not connect DB: ' . mysql_error());


        $sql = "SELECT * FROM `Users` WHERE `Username`='$Username' and `Password`='$Password'";
       mysql_query($sql); 
        $count = mysql_num_rows($result);

        if($count == 1)
        {
            $sql = "SELECT Role FROM Users WHERE Username='$Username' and Password='$Password'";
            mysql_query($sql); 
            $info = mysql_fetch_array($result);


            if($info['Role']== '0')
            {
                @header("location: http://localhost/Project/Superadmin.php");
            }
            else if($info['Role']== '1')
            {
                @header("location: http://localhost/Project/Admin.php");
            }
            else if($info['Role']== '2')
            {
                @header("location: http://localhost/Project/User.php");
            }
        }
        else
        {
            echo "<br><br><br><br><br><strong style='color:#FF3333'><left>Incorrect UserName OR Password</left></strong>";
        }
    }
}
?>
Edited by Reverend Jim because: Fixed formatting
  • 2 Contributors
  • 1 Reply
  • 334 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by as.bhanuprakash

Dani AI

Generated

As pointed out, the immediate cause is that the code calls the row-count function on something that is not a valid result resource — either the query return was never stored in a variable or the query failed. For : capture and check the query result before calling any result functions, and avoid suppressing errors so you can see what went wrong.

A safer, modern approach is to use prepared statements and store hashed passwords. The example below shows the recommended login flow with mysqli: connect, prepare, execute, verify the password, then redirect. It also demonstrates proper error checking and session use.

$db = new mysqli('10.70.1.50','invensis','invensis','database_myproject');
if ($db->connect_errno) { error_log($db->connect_error); /* handle */ }

$stmt = $db->prepare('SELECT id, password_hash, Role FROM users WHERE Username = ? LIMIT 1');
$stmt->bind_param('s', $username);
$stmt->execute();
$stmt->store_result();

if ($stmt->num_rows === 1) {
    $stmt->bind_result($id, $hash, $role);
    $stmt->fetch();
    if (password_verify($password, $hash)) {
        session_start();
        $_SESSION['uid'] = $id;
        header('Location: /Project/' . ($role === '0' ? 'Superadmin.php' : ($role === '1' ? 'Admin.php' : 'User.php')));
        exit;
    }
}

Quick checklist and tips:

  • If you keep old mysql_* calls, always assign the return of the query and check it (and mysql_error()) before calling mysql_num_rows.
  • Call escape functions only after the DB connection exists.
  • Do not put HTML inside a header() call; use header('Location: ...') then exit. Avoid the error-suppression operator.
  • Stop storing plaintext passwords — use password_hash()/password_verify().
  • Migrate to mysqli or PDO (prepared statements) and enforce HTTPS. These steps both fix the immediate warning and remove several security and compatibility issues.
Member Avatar for as.bhanuprakash 
$sql = "SELECT * FROM `Users` WHERE `Username`='$Username' and `Password`='$Password'";
mysql_query($sql); 
$count = mysql_num_rows($result);

In the above part you are missing the variable $result to recieve the resource returned by the mysql_query(). It should be ..

$sql = "SELECT * FROM `Users` WHERE `Username`='$Username' and `Password`='$Password'";
$result = mysql_query($sql); 
$count = mysql_num_rows($result);

Please use the code tags when you are including the code snippets in your posts.

Edited by mike_2000_17 because: Fixed formatting
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.