Warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in PHP?

Question

I promise, this will be the last question today. But I got an error 'Warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in /home/a1014025/public_html/practice/cart/cart.php on line 58' with this code:

<?php
include('connect.php');
session_start();
?>
<html>
<head>
    <title>Cart</title>
    <link rel='stylesheet' href='css/main.css' />
</head>
<body>
    <?php
    $page = 'index.php';

    if(isset($_GET['add'])){
        $add_id = $_GET['add'];
        $quantity = mysql_query("SELECT id, quantity FROM products WHERE id='$add_id'");
        while($quantity_row = mysql_fetch_assoc($quantity)){
            if($quantity_row['quantity'] !=@$_SESSION['cart_'.$add_id]){
                @$_SESSION['cart_'.$_GET['add']]+='1';
                header('Location: index.php');
            }
            else{
                header('Location: index.php?err=max');
            }
        }

    }

    if(isset($_GET['remove'])){
        $_SESSION['cart_'.(int)$_GET['remove']]--;
        header("Location: index.php");
    }

    if(isset($_GET['delete'])){
        $_SESSION['cart_'.(int)$_GET['delete']]='0';
        header('Location: index.php');
    }

    function products(){
        $get = mysql_query("SELECT id, name, description, price FROM products WHERE quantity > 0 ORDER BY id DESC");
        if(mysql_num_rows($get) == 0){
            echo "There are no products to display.";
        }
        else{
            while($get_row = mysql_fetch_assoc($get)){
                echo '<p>'.$get_row['name'].'<br />'.$get_row['description'].'<br />$'.$get_row['price'].' <a href="cart.php?add='.$get_row['id'].'">Add</a></p>';
            }
        }
    }

    function paypal_items(){
        $num = 0;
        foreach($_SESSION as $name => $value){
            if($value!=0){
                if(substr($name, 0, 5) == 'cart_'){
                    $id = substr($name, 5, strlen($name)-5);
                    $get = mysql_query("SELECT id, name, price, shipping, shipping2 FROM products WHERE id=".$id);
                    while($get_row = mysql_fetch_assoc($get)){
                        $num++;
                        echo '<input type="hidden" name="item_number_'.$num.'" value="'.$id.'">';
                        echo '<input type="hidden" name="item_name_'.$num.'" value="'.$get_row['name'].'">';
                        echo '<input type="hidden" name="amount_'.$num.'" value="'.$get_row['price'].'">';
                        echo '<input type="hidden" name="shipping_'.$num.'" value="'.$get_row['shipping'].'">';
                        echo '<input type="hidden" name="shipping2_'.$num.'" value="'.$get_row['shipping2'].'">';
                        echo '<input type="hidden" name="quantity_'.$num.'" value="'.$value.'">';

                    }
                }
            }
        }
    }

    function cart(){
        $total = 0;
        foreach($_SESSION as $name => $value){
            if($value>0){
                if(substr($name, 0, 5)=='cart_'){
                    $id = substr($name, 5, strlen($name)-5);
                    $get = mysql_query("SELECT id, name, price FROM products WHERE id='$id'");
                    while($get_row = mysql_fetch_assoc($get)){
                        $sub = $get_row['price']*$value;
                        echo $get_row['name'].' x '.$value.' @ $'.number_format($get_row['price'], 2).' = $'.$sub.' <a href="cart.php?add='.$id.'">[+]</a> <a href="cart.php?remove='.$id.'">[-]</a> <a href="cart.php?delete='.$id.'">[Delete]</a><br />';
                    }
                }
                $total += $sub; 
            }
        }
        if($total==0){
            echo "You cart is empty.";
        }
        else{
            echo "<p>Checkout with PayPal for your $".$total." total.</p>";
            ?>
            <form action="https://www.paypal.com/cgi-bin/webscr" method="post">
            <input type="hidden" name="cmd" value="_cart">
            <input type="hidden" name="upload" value="1">
            <input type="hidden" name="business" value="ddromano@comcast.net">
            <?php paypal_items(); ?>
            <input type="hidden" name="currency_code" value="USD">
            <input type="hidden" name="amount" value="<?php echo $total; ?>">
            <input type="image" src="http://www.paypal.com/en_US/i/btn/x-click-but03.gif" name="submit" alt="Make payments with PayPal - it's fast, free and secure!">
            </form>
            <?php

        }
    }

    ?>
</body>

Did you consider searching for your problem on Google? http://i.imgur.com/2YxuPMi.png — Waleed Khan, Feb 16 '13 at 01:05
Please search again https://www.google.com/search?q=Warning%3A+mysql_fetch_assoc()%3A+supplied+argument+is+not+a+valid+MySQL+result+resource — Waleed Khan, Feb 16 '13 at 01:07
You apparently did not take the advice you were given in your previous question. — Kermit, Feb 16 '13 at 01:17

score 0 · Answer 1 · edited May 23 '17 at 12:18

Please stop suppressing errors in your script.

@$_SESSION['cart_'.$_GET['add']]+='1';

Enable error reporting to give you a better idea of where the problems in your script are.

Line 58 in that code points to:

57  $get = mysql_query("SELECT id, name, price, shipping, shipping2 FROM products WHERE id=".$id);
58  while($get_row = mysql_fetch_assoc($get)){
    ...

Since you're using the mysql_ resource within a function, the connection is most likely out of scope. You must pass the connection to the function or globalize the connection.

function paypal_items($conn){

Or

function paypal_items(){
    global $conn;

I've mentioned it in your previous question and you seem to be ignoring it; your script is vulnerable to SQL injection. I strongly urge you to learn what this is, fix it and move to mysqli_ or PDO.

score -1 · Answer 2 · answered Feb 16 '13 at 01:14

-1

Looks like you have an error in your SQL on Line 57 - your value for id should be in quotes:

$get = mysql_query("SELECT id, name, price, shipping, shipping2 FROM products WHERE id='".$id."'");

You could have had php report this automatically by using or:

$get = mysql_query(...) or die(mysql_error());

By the way, you really should sanitize your queries before submitting them. Any time you pass a variable into a SQL statement, use mysql_real_escape_string to prevent SQL injection.

answered Feb 16 '13 at 01:14

Dale Caffull

101
1
5

1

`mysql_real_escape_string` will **not** prevent SQL injection. OP needs to use parameterized statements. Further, `id` does **not** need to be in quotes or escaped. – Kermit Feb 16 '13 at 01:17

Warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in PHP?

2 Answers2