-1

I have a column phone which contains a value like this:

["1740235959","9106597107","9369326058","9168187280","9393503006","9169124377","9378152001","9168176167","9385156441","9166118105","9166110676"]

which are phone found.

sent and receive result to client by this:

if ($tag=='getFriends'){
    $tempArray = array();
    foreach ($_POST["phoneNumbers"] as $phoneNumber) {
        $friends = $db->getFriends($phoneNumber);
        array_push($tempArray,($friends));
    }
    echo json_encode($tempArray);
}

And Here is my getFriends() method:

public function getFriends($phoneNumber){
    $newNumber = substr($phoneNumber, -10);
    $result = mysql_query("SELECT * FROM users WHERE phone REGEXP '$newNumber' LIMIT 1") or die(mysql_error());
    $rows = mysql_num_rows($result);
    if ($rows>0) {
    $result = mysql_fetch_array($result);
    $response["error"] = FALSE;
    $response["getFriends"]["real_name"] = $result["real_name"];
    $response["getFriends"]["name"] = $result["name"];
    $response["getFriends"]["email"] = $result["email"];
    $response["getFriends"]["is_online"] = $result["is_online"];
    $response["getFriends"]["in_game"] = $result["in_game"];
    $response["getFriends"]["status"] = $result["status"];
    $response["getFriends"]["user_unique_id"] = $result["user_unique_id"];
    }else {
        $response["error"] = TRUE;
    }
    return $response;

}

And the error message I get:

Got error 'empty (sub)expression' from regexp

What am I doing wrong?

miken32
  • 42,008
  • 16
  • 111
  • 154
shirin
  • 129
  • 1
  • 9
  • what are you trying to achieve with `$newNumber = substr($phoneNumber, -10);`? – mitkosoft Mar 28 '16 at 10:59
  • Your problem seems to be related to how regex works in `MySql`. Take a look [here](http://stackoverflow.com/questions/31336295/mysql-regex-got-error-empty-subexpression-from-regexp), seems the OP faced the same problem and the solution proposed fixed it. – Veverke Mar 28 '16 at 15:02
  • I would first think about refactoring/normalizing your database. Why would you want to do a regex search on a serialized structured data string like that, as opposed to actually put the data into a table that you can query against efficiently? This especially seems critical as, if you are wanting to make friend relationships (i.e. searching for friends and such) through this phone field, your current DB schema is going to be horribly inefficient, especially as more friend relationships are added. Your current query cannot use an index at all. – Mike Brant Mar 28 '16 at 21:38
  • @mitkosoft To convert `09123456789` or `+989123456789` **to** `123456789` – shirin Mar 29 '16 at 01:14
  • Can you post here what do you have in `$_POST["phoneNumbers"]`. The code is fine in general and it seems to works properly. – mitkosoft Mar 29 '16 at 06:43

1 Answers1

1

If I understand what you're trying to do, you aren't even using a regular expression. Just check WHERE phone = '$newNumber' or, if you want to be more inclusive, WHERE phone LIKE '%$newNumber%' instead.

Also, you must surely know that mysql_* functions are not available in the current version of PHP, have been deprecated for 6 years, and expose you to critical security vulnerabilities. Give me 30 seconds on your website and I'll have a dump of your entire users table.

Community
  • 1
  • 1
miken32
  • 42,008
  • 16
  • 111
  • 154