0

Getting this error and not sure what's going on. New to using mysqli.

$query = 'SELECT name, email FROM US__users WHERE state="' . $state . '" ORDER BY zip ASC LIMIT 5';
$result = $mysqli->query($query);

while ($row = $result->fetch_array()) {
  print ($row['name'] . ' ' . $row['email']);
}

$result->free();

There's currently only one row in MySQL DB. However, when I copy the $query and run it at the mysql command prompt, it queries fine and displays one result.

user3727412
  • 45
  • 1
  • 6
  • You should use a prepared statement with placeholders and bind your variable to this placeholder. That would take care of your error and your sql injection vulnerability too. – VMai Jun 19 '14 at 21:12
  • The variable comes from another php file and not something that a user can set. Each file has $state = ''; and depending which file they use, populates the $state variable in this query. So I don't believe that would be cause for SQL injection. – user3727412 Jun 19 '14 at 21:18
  • That's no cause not to use prepared statements. There are other issues too. Where is your error checking? – VMai Jun 19 '14 at 21:21

4 Answers4

2

The query string is syntactically incorrect. You have this:

$query = 'SELECT name, email FROM users WHERE state="' $state '" ORDER BY zip ASC LIMIT 5';

Try this instead using double quotes (") which allow for string substitution:

$query = "SELECT name, email FROM users WHERE state='$state' ORDER BY zip ASC LIMIT 5";

Or this if you want concatenation of values in the string for some reason:

$query = "SELECT name, email FROM users WHERE state='" . $state . "' ORDER BY zip ASC LIMIT 5";

Another idea if you still have issues is to use a prepared statement method; you never know if state needs to be filtered or not. So try this.

$query = "SELECT name, email FROM US__users WHERE state=? ORDER BY zip ASC LIMIT 5";

$stmt = $mysqli->prepare($query);

$stmt->bind_param('s', $state);

$result = $stmt->execute();

$stmt->close();

while ($row = $result->fetch_array()) {
  print ($row['name'] . ' ' . $row['email']);
}

$result->free();
Giacomo1968
  • 25,759
  • 11
  • 71
  • 103
0

You are missing concatenation on your query definition:

$query = 'SELECT name, email FROM users WHERE state="' . $state . '" ORDER BY zip ASC LIMIT 5';

Take a look at following link for further info: call to a member function non-object

Community
  • 1
  • 1
aaronfc
  • 190
  • 8
-1

Query is breaking due to

state="' $state '"

Try as

$query = "SELECT name, email FROM 
users WHERE state='$state' ORDER BY zip ASC LIMIT 5";
Giacomo1968
  • 25,759
  • 11
  • 71
  • 103
Abhik Chakraborty
  • 44,654
  • 6
  • 52
  • 63
-1

It could be a PHP bug? Just faced the same issue. So it doesn't work as you wanted (for future people, who like me will be searching for the answer): while ($row = $result->fetch_array()) {. But for some reason it works like this(looks pretty ugly though)

$query = 'SELECT name, email FROM US__users WHERE state="' . $state . '" ORDER BY zip ASC LIMIT 5';

while ($row = $mysqli->fetch_array($query)) {...
Shirker
  • 1,233
  • 2
  • 18
  • 30