The output of my if statement is always the same

Question

The SQL is correct because when I execute the SQL in phpMyAdmin it gives me the correct output. The code below always gives me the output 'instructor.' How can I solve this??

queryMysql($query) { 
    global $conn; 
    $result = $conn->query($query); 
    if (!$result) { 
        die($conn->error); 
    } 
    return $result; 
}



  $usertype = queryMysql("SELECT UserType FROM users WHERE Username='$user' AND Password='$pass'");
  $student = 'Student';
  $teacher = 'Teacher';
  $instructor = 'Instructor';
  if ($usertype === $student){
      echo 'student';
  } elseif ($usertype === $teacher) {
      echo 'teacher';
  } else {
      echo 'instructor';
  }

[Your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — Jay Blanchard, Jan 28 '16 at 15:55
Please use PHP's [built-in functions](http://jayblanchard.net/proper_password_hashing_with_PHP.html) to handle password security. If you're using a PHP version less than 5.5 you can use the `password_hash()` [compatibility pack](https://github.com/ircmaxell/password_compat). — Jay Blanchard, Jan 28 '16 at 15:56
Maybe that magic `queryMysql` function is preventing sql injection attacks :) I doubt it does but.. maybe — Mihai Matei, Jan 28 '16 at 15:57
@MateiMihai How should it prevent injection? He's already inserting the variables into the query before running his magic function. I doubt even a lot of magic would help him out. — Charlotte Dunois, Jan 28 '16 at 15:59
Verify what the query returns. Bonus: you can replace those nasty if/else statements with `echo strtolower($userType);` — Mihai Matei, Jan 28 '16 at 15:59
I've got $2 that says it doesn't @MateiMihai ¯\\_(ツ)_/¯ We have no idea which API the OP is using at this point. — Jay Blanchard, Jan 28 '16 at 16:00
Verify what's being returned by `queryMysql` since you didn't post it; I am assuming its either returning an array or nothing at all. :) — yardie, Jan 28 '16 at 16:00
@RichardTheobald The output for the username and password I am using shoult be Student and this is what comes up when i do it through phpMyAdmin. Through the php script i get the error 'Object of class mysqli_result could not be converted to string'. — mysterykid, Jan 28 '16 at 16:00
what is the return of queryMysql? resource, array or string. seems like the return is not always the string here. — ameenulla0007, Jan 28 '16 at 16:01
@JayBlanchard - I am in on the bet, (I think it is cleansed) *fingers crossed* ^__^ — yardie, Jan 28 '16 at 16:01
You can use a `preg_match_all` to match the strings and replace them with binds.. It's not impossible.. @JayBlanchard I'm with you as well.. I don't think it went that far — Mihai Matei, Jan 28 '16 at 16:01
@ameenulla0007 The output for the username and password I am using shoult be Student and this is what comes up when i do it through phpMyAdmin. Through the php script i get the error 'Object of class mysqli_result could not be converted to string'. — mysterykid, Jan 28 '16 at 16:03
I'd guess that $usertype and $student are not of the same type and therefore not identical (===). Try equal (==) instead. — Aziuth, Jan 28 '16 at 16:03
Please do not dump code in comments @mysterykid Edit your original post to add any new information. — Jay Blanchard, Jan 28 '16 at 16:04
you should `return $result->fetch_assoc();` and after calling the function `echo strtolower($result['UserType']);` — Mihai Matei, Jan 28 '16 at 16:04
Oh somebody write it up in an answer or we will be here all day — RiggsFolly, Jan 28 '16 at 16:08

Jay Blanchard · Answer 1 · 2016-01-28T16:46:32.480

2

Because of the magic of $conn->query() you're getting the results back from your query, all you have to do is use the right format to get the data. One way is to fetch an associative array and return that:

queryMysql($query) { 
    global $conn; 
    $result = $conn->query($query); 
    if (!$result) { 
        die($conn->error); 
    } 
    return $result->fetch_assoc(); 
}

$result is now an array and its parts can be accessed by providing identifiers, which you can take advantage of like this:

 if ($usertype['UserType'] === $student){
      echo 'student';
  } elseif ($usertype['UserType'] === $teacher) {
      echo 'teacher';
  } else {
      echo 'instructor';
  }

edited Jan 28 '16 at 16:46

answered Jan 28 '16 at 16:19

Jay Blanchard

34,243
16
77
119

If you read the comments on the question, you'll note that $conn isn't a PDO object, which is what you linked from the docs. – Richard Theobald Jan 28 '16 at 16:31
@RichardTheobald I was going to make a mention of that too, but the principle is the same (the function is still generic). But Jay will rectify that, am sure ;-) – Funk Forty Niner Jan 28 '16 at 16:34
1

Thank you for your response/help! I still get the error: Cannot use object of type mysqli_result as array. So i shall ask my teacher about it tomorrow because there may be an error elsewhere. One again, thanks a lot! :) – mysterykid Jan 28 '16 at 16:56

score 0 · Answer 2 · answered Jan 28 '16 at 16:08

0

I think it will solve your problem.

    $result = mysql_query("SELECT UserType FROM users WHERE Username='$user' AND Password='$pass'");
    $usertype = mysql_fetch_array($result);
    $student = 'Student';
    $teacher = 'Teacher';
    $instructor = 'Instructor';
    if ($usertype['UserType'] == $student){
      echo 'student';
    } elseif ($usertype['UserType'] == $teacher) {
      echo 'teacher';
    } else {
      echo 'instructor';
    }

answered Jan 28 '16 at 16:08

Tayyab Ahmed

83
3

2

Please [stop using `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php). [These extensions](http://php.net/manual/en/migration70.removed-exts-sapis.php) have been removed in PHP 7. Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [PDO](http://php.net/manual/en/pdo.prepared-statements.php) and [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and consider using PDO, [it's really pretty easy](http://jayblanchard.net/demystifying_php_pdo.html). – Jay Blanchard Jan 28 '16 at 16:08
1

I second Jay's comment, stop using mysql_*. It's tea time ^__^ – yardie Jan 28 '16 at 16:10
The issue is not in your mysql_* functions. In main question $usertype = queryMysql("SELECT UserType FROM users WHERE Username='$user' AND Password='$pass'"); I will return a whole set of array. so you need to compare $usertype['UserType'] in the if statements. – Tayyab Ahmed Jan 28 '16 at 16:11
What is $usertype returning ? Use echo $usertype; – Tayyab Ahmed Jan 28 '16 at 16:22
@TayyabAhmed it currently returns an error: Cannot use object of type mysqli_result as array – mysterykid Jan 28 '16 at 16:24
2

Why should the OP try this? Why do you think it will solve the problem? A ***good answer*** will always have an explanation of what was done and why it was done that way, not only for the OP but for future visitors to SO. – Jay Blanchard Jan 28 '16 at 16:24
Use mysqli_fetch_assoc or mysqli_fetch_array to fetch a result row as an associative array. – Tayyab Ahmed Jan 28 '16 at 16:28
You still have code which will make the OP go backwards instead of moving on to newer API's which are safer and easier to use. – Jay Blanchard Jan 29 '16 at 16:47

score 0 · Answer 3 · answered Jan 28 '16 at 16:17

In your code, $result is a result object rather than the actual results. You need to do something like this:

queryMysql($query) { 
    global $conn; 
    $dbQuery = $conn->query($query);
    $result = $dbQuery->fetch_assoc(); //this gets the actual row rather than just the mysqli_result object
    if (!$result) { 
        die($conn->error); 
    } 
    return $result; 
}

score 0 · Answer 4 · answered Jan 28 '16 at 16:25

Your code fails because queryMysql() return an object instead of expected string. As suggested in comments, you have to change your function in this way:

function queryMysql( $query ) 
{ 
    (...) 
    return $result->fetch_assoc();
}

then you obtain an associative array with keys as your table column names.

So, you can continue in this way:

$usertype = queryMysql("SELECT UserType FROM users WHERE Username='$user' AND Password='$pass'");
echo strtolower($usertype['UserType']);

as suggested in the comments, or - if you prefer - in your way:

$student = 'Student';
(...)
if( $usertype['UserType'] === $student ) {
(...)
}

Exploring the PHP Documentation (including comments) you can found how improve your mySQL searches.

... and have fun with coding!

Thank you for your response/help and I understand what I have done wrong. However I still get the error: Cannot use object of type mysqli_result as array. Due to the echo strtolower part and the if statement as a whole. I will ask my teacher about it tomorrow :) — mysterykid, Jan 28 '16 at 16:47
but have you modified the `queryMysql` function? last line `return $result->fetch_assoc();`, not `return $result` — fusion3k, Jan 28 '16 at 17:05

score 0 · Accepted Answer · answered Jan 28 '16 at 17:04

I managed to get it to work by leaving the original mysql() function the same (as it is used elsewhere for another purpose) and simply using fetch_assoc() for this query (which i'm sure someone mentioned somewhere in the comments so sorry) Thanks to all of your for your help!! :)

      $usertype = queryMysql("SELECT UserType FROM users WHERE Username='$user' AND Password='$pass'");
      $result2 = $usertype->fetch_assoc();
      $student = 'Student';
      $teacher = 'Teacher';
      $instructor = 'Instructor';
      if ($result2['UserType'] === $student){
      echo 'student';
      } elseif ($result2['UserType'] === $teacher) {
      echo 'teacher';
      } else {
      echo 'instructor';
      }

The output of my if statement is always the same

5 Answers5