Cannot echo result from mysql

Question

All I need is to produce a row. I've looked at all the samples and I cannot for the life of me get the right information. Hence help is required please.

Connection to DB in the usual way. Here is my code for the query.

$sql = "SELECT * FROM table WHERE `u_password` = $pword AND `user` = $uname LIMIT 1";
$result = mysqli_query($mdb, $sql);
$row = mysqli_fetch_assoc($result);
//Then I try to retrieve say the user name....
echo $row['seeking'];

I've got a count in there and it produces a result of 1. The error I get is 'Warning: mysqli_fetch_array() expects parameter 1 to be mysqli_result'

Help would be appreciated.

If you could edit your title; the title should describe as closely as possible what your question is about, not your personal feelings about the question. — Peter David Carter, May 19 '16 at 09:54
This is an example where if you used proper prepared queries it would have worked. — apokryfos, May 19 '16 at 09:59
Possible duplicate of [mysql\_fetch\_array()/mysql\_fetch\_assoc()/mysql\_fetch\_row() expects parameter 1 to be resource or mysqli\_result, boolean given](http://stackoverflow.com/questions/2973202/mysql-fetch-array-mysql-fetch-assoc-mysql-fetch-row-expects-parameter-1-to) — Thamilhan, May 19 '16 at 10:02

score 2 · Accepted Answer · edited May 23 '17 at 12:23

The error

Warning: mysqli_fetch_array() expects parameter 1 to be mysqli_result

Almost always means that the query failed for some reason, thus $result = mysqli_query returns FALSE rather than a mysql_result object so anything that then tries to use $result as an object will not work for obvious reasons.

The issue with your query is that text column data must be wrapped in quotes like this

$sql = "SELECT * 
        FROM table 
        WHERE `u_password` = '$pword' AND `user` = '$uname' LIMIT 1";

Your script is at risk of SQL Injection Attack Have a look at what happened to Little Bobby Tables Even if you are escaping inputs, its not safe!

You should use parameterized queries to avoid this.

$sql = "SELECT * 
        FROM table 
        WHERE `u_password` = ? AND `user` = ? LIMIT 1";
$stmt = mysqli_prepare($mdb, $sql);
// its also a good idea to check the staus of a prepare 
// and show the error if it failed, at least while testing
if ( $stmt === FALSE ) {
    echo mysqli_error($mdb);
    exit;
}
$stmt->bind_param('ss', $pword, $uname );
$stmt->execute();
$result = $stmt->get_result();
$row = $result->fetch_assoc();
echo $row['seeking'];

No look at the variables `$pword` I wrapped that in single quotes like `'$pword'` Thats single quotes and NOT backticks — RiggsFolly, May 19 '16 at 10:12
Did you use one of my code options ro just amend your query string — RiggsFolly, May 19 '16 at 10:38
Made a small amendment to complete the process of retrieving the data as well — RiggsFolly, May 19 '16 at 10:43

score 0 · Answer 2 · answered May 19 '16 at 10:07

You need to use prepared statements (in actuality you could get it to work by quoting your strings but prepared statements are much better). Like so:

$sql = "SELECT * FROM table WHERE `u_password` = ? AND `user` = ? LIMIT 1";
$stmt = mysqli_prepare($mdb, $sql); 
$stmt->bind_param("ss",$pword,$uname);

if ($stmt->execute()) {
    $result = $stmt->get_result();
    $row = mysqli_fetch_assoc($result);
     //Then I try to retrieve say the user name....
    echo $row['seeking'];
} else { /* something went wrong */ }

Cannot echo result from mysql

2 Answers2