Member Avatar for janicemurby

hi i managed to change my site from mysql to mysqli with all your help

although i have one line thats causing me problems in inbox.php can someone check this out and see whats wrong the error im getting is
Warning: mysqli_fetch_array() expects parameter 1 to be mysqli_result, boolean given in /home/jktempla/public_html/inbox.php on line 202
heres code for that section

<?php 
      // Fetch user random for display on bottom
      $topuid = array();
      $idtopuid     = implode(',', $topuid);
      $userquery    = mysqli_query($conn, "select * from user where user_id != '".$_SESSION['userid']."' and user_id NOT IN (".$idtopuid.") order by rand() limit 0,5");
      while($fetch_query=mysqli_fetch_array($userquery)) //this is the line concerned
      {
          $show_memtype  = $fetch_query['user_memtype'];
          $show_id      = $fetch_query['user_id']; 
          $fetch_img2   = mysqli_fetch_array(mysqli_query($conn, "select user_image from user_images where user_id = '".$show_id."' and main_image = '1' "));
          $show_img     = $fetch_img2['user_image'];
          ?>

so after reading through the forum on here i so a post where add error die to it so i put the following in

<?php 
      // Fetch user random for display on bottom
      $topuid = array();
      $idtopuid     = implode(',', $topuid);
      $userquery    = mysqli_query($conn, "select * from user where user_id != '".$_SESSION['userid']."' and user_id NOT IN (".$idtopuid.") order by rand() limit 0,5") or die( mysqli_error($conn) );  //line changed
      while($fetch_query=mysqli_fetch_array($userquery))
      {
          $show_memtype  = $fetch_query['user_memtype'];
          $show_id      = $fetch_query['user_id']; 
          $fetch_img2   = mysqli_fetch_array(mysqli_query($conn, "select user_image from user_images where user_id = '".$show_id."' and main_image = '1' "));
          $show_img     = $fetch_img2['user_image'];
          ?>

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ') order by rand() limit 0,5' at line 1

Thankyou for all your help so far any help is much appreciated

  • 2 Contributors
  • 2 Replies
  • 359 Views
  • 3 Hours Discussion Span
  • Latest Post Latest Post by janicemurby

Dani AI

Generated

As correctly identified, the runtime error came from constructing an empty IN() clause. A practical, robust approach is to (a) avoid injecting raw CSV into SQL and (b) only add the NOT IN fragment when you actually have values to exclude. Use prepared statements and sanitize IDs (or quote strings) to prevent SQL injection, and check query results instead of relying on die() in production.

Example pattern with mysqli (sanitizing IDs as integers and conditionally adding the clause):

// sanitize and build optional NOT IN fragment
$exclude = array_map('intval', $topuid);
if (count($exclude)) {
    $notIn = implode(',', $exclude); // safe because of intval cast
    $sql   = "SELECT user_id, user_memtype FROM user
              WHERE user_id != ? AND user_id NOT IN ($notIn)
              ORDER BY RAND() LIMIT 5";
} else {
    $sql   = "SELECT user_id, user_memtype FROM user
              WHERE user_id != ? ORDER BY RAND() LIMIT 5";
}

$stmt = $conn->prepare($sql);
$sessionId = (int) $_SESSION['userid'];
$stmt->bind_param('i', $sessionId);
$stmt->execute();
$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
    // process rows
}

For the nested image lookup, prepare a small query and provide a sensible fallback if no image exists (do not assume the inner query always returns a row). Also: prefer explicit column lists over SELECT *.

A few extra tips: avoid ORDER BY RAND() on large tables (it is slow); instead sample IDs first or use a precomputed random column/index. Log errors rather than using die() in production and verify $_SESSION['userid'] exists before using it. If you need easier dynamic binding for variable-length IN() lists, consider PDO (or build safe placeholders and bind parameters dynamically). These changes will make the code both safer and more reliable for future use — useful once the quick fix that applied is no longer sufficient.

Recommended Answers

All 2 Replies

Member Avatar for cereal

The problem is generated in the IN() statement: what happens if $topuid is empty, like in your code?

$topuid   = array();
$idtopuid = implode(',', $topuid);

The result of $idtopuid will be an empty string, example:

var_dump(implode(',', []));
string(0) ""

This will generate the syntax error you got: syntax to use near ') order by rand() limit 0,5' at line 1 because the IN() statement cannot be empty.

Also, keep in mind that you are setting something that will display as a single CSV string, for example:

$topuid   = ['a', 'b', 'c'];
$idtopuid = implode(',', $topuid);

# in query
... IN(".$idtopuid.") ...

Will generate:

IN(a,b,c)

without quotes, which will work fine if these will be integers [1,2,3], but it will fail if using alphanumeric IDs, because it will be like testing table columns and it could generate an error like:

ERROR 1054 (42S22): Unknown column 'a' in 'where clause'

to avoid it, in case of alphanumeric IDs, the IN() statement values should be set with quotes around each element and commas to separate them, so:

IN('a', 'b', 'c')

Bye!

Edited by cereal
Member Avatar for janicemurby

ty hun works perfect adding the ('a', 'b' , 'c')

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.