MySQL connect function runs even if the username is wrong

Question

I already know that if you want to connect to a database using MySQL you have to provide the correct URL, username, password that is the normal thing here is my code:

<?php
$mysql_id = mysql_connect('localhost', 'root', '');
mysql_select_db('Booklet', $mysql_id);
if(!$mysql_id)
{
echo"cannot connect to database ";
}
?>

This code runs well, however if I messed with the username which is root it still connects here is the code:

<?php
$mysql_id = mysql_connect('localhost', 'rot', '');
mysql_select_db('Booklet', $mysql_id);
if(!$mysql_id)
{
echo"cannot connect to database ";
}
?>

Can anyone explain to me why is this happening?

Please, [stop using `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php). They are no longer maintained and are [officially deprecated](https://wiki.php.net/rfc/mysql_deprecation). Learn about [prepared statements](http://en.wikipedia.org/wiki/Prepared_statement) instead, and use [PDO](http://jayblanchard.net/demystifying_php_pdo.html). — Jay Blanchard, Apr 24 '15 at 15:51

score 2 · Answer 1 · answered Apr 24 '15 at 15:51

2

You never bothered checking for failure. Your code simply assumes success and blunders onwards.

$mysql_id = mysql_connect('localhost', 'rot', '') or die(mysql_error());
                                                 ^^^^^^^^^^^^^^^^^^^^^^
mysql_select_db('Booklet', $mysql_id) or die(mysql_error());

All of the mysql_*() function return boolean false on failure. You need to check for that false. Never ever assume a DB operation succeeded. Always assume failure, check for that failure, and treat success as a pleasant surprise.

answered Apr 24 '15 at 15:51

Marc B

356,200
43
426
500

Isn't the OP's if(!$mysql_id) making that check? – BigScar Apr 24 '15 at 15:57
yes, which is too late. the connect call failed, which means the select_db call failed. every single DB call can potentially fail, so you can't skip the error check at any stage. – Marc B Apr 24 '15 at 15:57
@Marc B The OP is checking the connection as BigScra poimted out and should be getting the echo regardless. As to OR DIE! Pleeese! Teaching someone to code like that is teaching them to invite hackers. The error is going to appear on the page and reveal all sorts of information, including the fact that you have no idea about security. – David Soussan Apr 24 '15 at 16:11
@david: checking at that point in the call is pointless. the false from the failed connect has already been used in the select db and caused further failures. so my point remains: failing to check the result of ANY db operation is a bad idea. `or die()` is the very simplest/most barebones error handler available. – Marc B Apr 24 '15 at 16:11

Mekap · Accepted Answer · 2015-04-24T16:41:19.807

As of PHP 5.5.0 mysql_* functions are deprecated and you should not code with thoses. Think of thoses function as a crawling zombie, you don't go and kiss it, do you ?

You should use MySQLi or PDO for doing operations on database. Please don't bother with mysql_* anymore, you dont want that. It's like asking to code on Windows Milenium, hell, even booting this thing is a nightmare.

Anyway, to answer the question you should write :

$mysql_id = mysql_connect('localhost', 'rot', '') or die(mysql_error());

Or better, you should look at the doc of MySqli and be free of thoses shackles. Think about that, please.

score 0 · Answer 3 · answered Apr 24 '15 at 15:56

This extension is deprecated as of PHP 5.5.0, and will be removed in the future. Instead, the MySQLi or PDO_MySQL extension should be used.

try to debug your code by adding mysql_error() like this

$mysql_id = mysql_connect('localhost', 'rot', '');
mysql_select_db('Booklet', $mysql_id);


    echo " debug return:  " . mysql_error();

or simply update your code if you have a newest version of php > 5.5.0

$mysql_id = mysqli_connect("myhost","myuser","mypassw","mybd") or die("Error " . mysqli_error($link));

score 0 · Answer 4 · answered Apr 24 '15 at 15:59

Using the new MySQLi functions, you would get a false back on trying to connect, also you can pass you database as fourth parameter. So your code could look like this:

<?php

    if($mysql_id = mysqli_connect('localhost', 'root', '', 'Booklet'))
    {
        /* do something like mysqli_query($mysql_id, ... */
    }
    else
    {
        echo"cannot connect to database ";
    }
?>

MySQL connect function runs even if the username is wrong

4 Answers4