select statement wont produce result..

[DanShadow]

Hello there!

I am currently doing some work for a client, but have run into a bit of an issue.
I am trying to retrieve a specific row from a table, by using a SELECT statement with a WHERE clause, but am not receiving a result at all!

Does anybody have any idea why this is producing no result (no error either)?

PHP Code wrote:

$query = "select * from registration where username='$username' and password='$password' and account_status='1'";

$result = mysql_query($query);
$total = mysql_num_rows($result);
$ress = mysql_fetch_object($result);

//Retrieve user ID
while($row = mysql_fetch_array($result))
{
$user_id = $row["id"];
}

Thanks!!!!

[Tony]

Have you tried that with:

code:

$username = "foo' or 1=1; --"

The other question being: is there anything actual in the database to be selected? Database questions make more sense with samples of queries and outputs from the mysql console on a test database, not php code.

[DanShadow]

Here is a little more information, heh.

registration table structure wrote:

username VARCHAR
password VARCHAR
id INT NOT NULL
account_status INT

PHP Code wrote:

$query = "select * from registration where username='testaccount' and password='asdf' and account_status='1'";

$result = mysql_query($query);
$total = mysql_num_rows($result);
$ress = mysql_fetch_object($result);

//Retrieve user ID
while($row = mysql_fetch_array($result))
{
$user_id = $row["id"];
}

Attempts to select a unique record (where the username 'testaccount' makes it unique) in the database, and take the row "id" (which will always be NOT NULL) and store it in the variable "$user_id".

The only result I get is.. nothing. ""

I've verified the record in the database, that the username, password, and account_status are all correct, and that the id is not null, and there.

Still, whenever I try to query for the id I get a blank result.

Me = puzzled, lol

[DemonWasp]

Just a guess (not an SQL pro) but given as account_status is an INT, shouldn't you NOT quote the value 1 in your query?

[DanShadow]

Heh, good call. I removed the quotes, but the problem still remains the same =/.

Is there perhaps another way I should be using for fetching the row data from the query result?

[Tony]

So just to be clear, that query returns results when ran directly against the database, but fails to produce results when wrapped in PHP?

[DanShadow]

Sorry I think I mis-worded my request >.<

The SELECT query succeeds, and the result is currect.

But when trying to retrieve the 'id' by using mysql_fetch, the $row["id"] produces a blank result, even though the actual query result has the correct rows.

My assumption is the way I am trying to retrieve the data from the row "id", and store it in a PHP variable is causing me to get a blank result.

Sorry about the confusion!

[DanShadow]

I figured out the problem, of course something so simple as a syntax error -_-.

It was $row['id'] not $row["id"].

Thanks for the help/quick responses guys!!

[Tony]

wait, 'id' and "id" are not the same thing? PHP continues to blow my mind.

[DemonWasp]

Well...in several languages, single-quotes mean a single character, double quotes mean a string. But then in JSON and YAML, they both mean string. Why they would be so subtly different (both mean strings, except not quite) in PHP is just another PHP-ism.

[2goto1]

I've always wondered why languages don't support implicit conversion from their character to string types at compilation or runtime, when the types are different.