Warning: mysql_result(). Unable to solve

Question

Im getting this Error:

Warning: mysql_result(): supplied argument is not a valid MySQL result resource

Ive checked other questions on this and can't seem to find the answer. Any thoughts on it?

$query = mysql_query("SELECT COUNT(`id`) FROM `users` WHERE `username` = '$username' AND `active` == 1");
return(mysql_result($query, 0) == 1) ? true : false;

Remove the `' '` from `username` – asprin May 02 '13 at 05:48 — asprin, May 02 '13 at 05:48

score 3 · Answer 1 · edited May 23 '17 at 12:18

3

The reason why your query won't work is because your are wrapping the column name and table name with single quotes. They are identifiers and not string literals so they shouldn't be wrap with single quote.

SELECT COUNT(id) FROM users WHERE username = '$username'

If it happens that the column names and tables names used are a reserved keyword, they can be escape with backticks not with single quotes.

In this case, the backticks aren't required since none of them are reserved keywords.

Other links:

As a sidenote, the query is vulnerable with SQL Injection if the value(s) of the variables came from the outside. Please take a look at the article below to learn how to prevent from it. By using PreparedStatements you can get rid of using single quotes around values.

How to prevent SQL injection in PHP?

edited May 23 '17 at 12:18

Community

1
1

answered May 02 '13 at 05:47

John Woo

258,903
69
498
492

+1 for precise explanation – asprin May 02 '13 at 05:49
Im very sorry about this but I am now receiving the warning on a different line but changed it according to the other one. Would you be kind enough to look at that one? Its above – RightLeftRight12 May 02 '13 at 06:03
the problem is here `active == 1`, it should be `active = 1` – John Woo May 02 '13 at 06:04
http://php.net/manual/de/mysqli.prepare.php :: you should never parse a variable directly into a sql statement to avoid sql injections – MatthiasLaug May 02 '13 at 06:05
what's missing on this? – John Woo May 02 '13 at 07:34

Yogesh Suthar · Accepted Answer · 2013-05-02T06:05:27.503

2

the query should be, you used ' around column name, you have to surround the it with `

mysql_query("SELECT COUNT(`id`) FROM `users` WHERE `username` = '$username'");

change this

`active` == 1");

to

`active` = 1");

edited May 02 '13 at 06:05

answered May 02 '13 at 05:47

Yogesh Suthar

30,424
18
72
100

Im not sure what is different about it? – RightLeftRight12 May 02 '13 at 05:49
I don't see a downvote – asprin May 02 '13 at 05:49
One is the regular apostrophe, the other is the ` mark on the tilde key. – Brent May 02 '13 at 05:50

score 1 · Answer 3 · answered May 02 '13 at 05:48

1

This is not a correct way of escaping column use backtick operator if you wish to like this

$query = mysql_query("SELECT COUNT(`id`) FROM `users` WHERE `username` = '$username'");

answered May 02 '13 at 05:48

chandresh_cool

11,753
3
30
45

Warning: mysql_result(). Unable to solve

3 Answers3