Why wont my While work when i use a variable in my mysql_query

Question

I've got the php script but it doesn't seem to run the while on it.

It's always worked before but today it didn't work.

include('../conect_to_myspl.php');
$email  = $_GET['e'];
$password = $_GET['p'];
$remember = $_GET['r'];
$selectEmail = mysql_query("SELECT * FROM users WHERE email='$email'");
while($row = mysql_fetch_assoc($selectEmail)){

 $passowrdFromDB = $row['password'];
 $username = $row['username'];
 if($passowrdFromDB == $password){
 session_start();
 $_SESSION['username'] = $username;
 echo 1 ;
 }else{
 echo 0 ;
 }
 }

Answer 1

"i only get "Deprecated : mysql_connect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in "

I'm willing to bet my last dollar that your DB connection is mysqli_* and not mysql_* based. Yet, if it is mysql_ then you need to change that to mysqli_ see my example test that follows.

Change all instances of mysql_ to mysqli_ and add $con before SELECT or whatever variable you are using for DB connection in your connect file.

Assuming DB connection variable is $con (tested with a similar DB I already have on my server).

include('../conect_to_myspl.php');
$email  = $_GET['e'];
$password = $_GET['p'];
$remember = $_GET['r'];
$selectEmail = mysqli_query($con, "SELECT * FROM users WHERE email='$email'");
while($row = mysqli_fetch_assoc($selectEmail)){

 $passowrdFromDB = $row['password'];
 $username = $row['username'];
 if($passowrdFromDB == $password){
 session_start();
 $_SESSION['username'] = $username;
 echo 1 ;
 }else{
 echo 0 ;
 }
 }

Add error reporting to the top of your file(s)

error_reporting(E_ALL);  
ini_set('display_errors', 1); 
mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);

---

This is the code I tested with, using all mysqli_* functions for connection and query.

<?php

error_reporting(E_ALL);
ini_set('display_errors', 1);

mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);

/*
$email  = $_GET['e'];
$password = $_GET['p'];
$remember = $_GET['r'];
$selectEmail = mysql_query("SELECT * FROM users WHERE email='$email'");
while($row = mysql_fetch_assoc($selectEmail)){

 $passowrdFromDB = $row['password'];
 $username = $row['username'];
 if($passowrdFromDB == $password){
 session_start();
 $_SESSION['username'] = $username;
 echo 1 ;
 }else{
 echo 0 ;
 }
 }
*/

$DB_HOST = "xxx";
$DB_NAME = "xxx";
$DB_PASS = "xxx";
$DB_USER = "xxx";

$db = new mysqli($DB_HOST, $DB_USER, $DB_PASS, $DB_NAME);
if($db->connect_errno > 0) {
  die('Connection failed [' . $db->connect_error . ']');
}

if($db->connect_errno > 0){
    die('Unable to connect [' . $db->connect_errno . ']');
}

$email  = "user1";
$password = "123";
// $remember = $_GET['r'];
$selectEmail = mysqli_query($db,"SELECT * FROM users WHERE email='$email'");
while($row = mysqli_fetch_assoc($selectEmail)){

 $passowrdFromDB = $row['password'];
 $username = $row['username'];
 if($passowrdFromDB == $password){
 session_start();
 $_SESSION['username'] = $username;
 echo 1 ;
 }else{
 echo 0 ;
 }
 }

---

"yeah it is ,but when i change it (all of my mysql_) to mysqi_ it give me this error " mysql_fetch_assoc() expects parameter 1 to be resource, boolean given""

You're still using mysql_fetch_assoc() those two APIs do NOT mix. Everywhere where it says mysql_ MUST be changed to mysqli_ notice the i? Use mysqli_fetch_assoc()

---

Sidenote: Your present code is open to SQL injection. Use mysqli_* functions. (which I recommend you use and with prepared statements, or PDO)

Answer 2

$foo="foo";
$selectFoo = mysql_query("SELECT * FROM users WHERE email='".mysql_real_escape_string($foo)."'");
if($error = mysql_error()) die("Got an error: ".$error);
while($row = mysql_fetch_assoc($selectFoo)){
    echo 'yay';
}

I have sanitized the input string and used the mysql_error function to further investigate on the problem. Try this way.

However, you should switch to mysqli since the mysql extension will be removed in the future.