PHP, query failed

Question

I have this code and variable "p1" is an int. Debugger shows it takes values properly. But I get "query failed". Database values are set to int. Any help?

<?php
    session_start();
    include 'connect_db.php'; 
    $con = $_SESSION['connection'];

        $query = "SELECT * FROM class WHERE id_class ='".$_GET['p1']."'";
        $result=@mysql_query($con,$query) or die('Error, query1 failed');
        $num_result=mysqli_num_rows($result);


        if($num_result>0){

                $insert_query= " INSERT INTO user_program SET 
                                            id_class='".$_POST['id_class']."'
                                            WHERE id_user='".$_SESSION['id_user']."'";

        $insert=mysqli_query($con,$insert_query) or die('Error,query2 failed');


            if ($insert) {
                echo '<html><meta charset="UTF-8"><script language="javascript">alert("ok!"); document.location="add_classes_form.php";</script></html>';
            }
            else {
                echo '<html><meta charset="UTF-8"><script language="javascript">alert("not ok.")</script></html>';
                echo '<script language="javascript"> document.location="add_classes_form.php";</script>';
                exit();
            }   
        }

?>

change `mysql_query($con,$insert_query)` to `mysql_query($insert_query)` don't mix `mysql` and `mysqli` syntax — Mario, Mar 19 '17 at 12:34
If you're writing new code, **_please_ don't use the `mysql_*` functions**. They are old and broken, were deprecated in PHP 5.5 (which is so old it no longer even receives security updates), and completely removed in PHP 7. Use [`PDO`](https://secure.php.net/manual/en/book.pdo.php) or [`mysqli_*`](https://secure.php.net/manual/en/book.mysqli.php) with _prepared statements_ and _parameter binding_ instead. See http://stackoverflow.com/q/12859942/354577 for details. — ChrisGPT was on strike, Mar 19 '17 at 12:41
**You are wide open to [SQL Injections](http://php.net/manual/en/security.database.sql-injection.php)** and should really use [Prepared Statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) instead of concatenating your queries, which can be used if you use the above mentioned MySQLi or PDO. — M. Eriksson, Mar 19 '17 at 12:43
Remove the `@` in front of your call and you might get a useful error message instead of suppressing any potential errors. Suppressing error is _bad practice_. You should handle the errors instead, which will also help you when you're debugging your code, like you should do in this case. — M. Eriksson, Mar 19 '17 at 12:44
@MagnusEriksson. Thanks. I get an error now. mysql_query() expects parameter 1 to be string, object given — Nikos Kiriakakis, Mar 19 '17 at 12:49
That's because you're mixing `mysql_*` and `mysqli_*` and are using them wrong, as others have pointed out. They are two totally different api's.. _Don't_ use `mysql_*` — M. Eriksson, Mar 19 '17 at 12:50
i give u answer, u are using `INSERT` but making it like u `UPDATE`, proper way is `INSERT INTO tablename ( column1, column2 ) VALUES ( value1, value2 ) WHERE something = something u want` — Mario, Mar 19 '17 at 12:53
@MagnusEriksson. Thanks. Changed it. Now I get "Undefined index" error in both id_user and id_class — Nikos Kiriakakis, Mar 19 '17 at 12:54
@NikosKiriakakis again u have error in syntax `$result=@mysql_query($con,$query) or die('Error, query1 failed');` change this `mysql_query` to `mysqli_query` and check my edit — Mario, Mar 19 '17 at 13:34

Mario · Answer 1 · 2017-03-19T13:29:36.640

First of all, u can't mix mysql with mysqli as u can see in your example.

Mysql is deprecated but i will give u example just to see how it works in mysql and mysqli and what is diference between those two approach.

Avoid to use @ in query because u can't see if real error appear, this is a bad practice.

First of all this is a bad practice in both ways because its not secure even if u escape variables with mysql_real_escape_string() or mysqli_real_escape_string(). Instead of using this use PDO with prepared statements.

Use of mysqli

// mysqli connection
$con = mysqli_connect('host', 'username', 'password', 'database_name');

Code

<?php

session_start();
include 'connect_db.php';
$con = $_SESSION['connection'];

$p1 = mysqli_real_escape_string($con, $_GET['p1']);

$query = "SELECT * FROM class WHERE id_class = '$p1'";
$result = mysqli_query($con, $query) or die('Error, query failed');
$num_result = mysqli_num_rows($result);

$id_class = mysqli_real_escape_string($con, $_POST['id_class']);
$id_user = mysqli_real_escape_string($con, $_SESSION['id_user']);

if ($num_result > 0)
{
    $insert_query = "UPDATE user_program SET id_class = '$id_class' WHERE id_user = '$id_user'";

    $insert = mysqli_query($con, $insert_query) or die('Error,query failed');


    if ($insert)
    {
        echo '<html><meta charset="UTF-8"><script language="javascript">alert("OK!"); document.location="add_classes_form.php";</script></html>';
    }
    else
    {
        echo '<html><meta charset="UTF-8"><script language="javascript">alert("Not OK.")</script></html>';
        echo '<script language="javascript"> document.location="add_classes_form.php";</script>';
        exit();
    }   
}
?>

You should _really_ remove the `mysql_*` example since it's old, deprecated and insecure. You should also recommend using [Prepared Statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) instead of escaping the inputs since even `mysqli_real_escape_string()` can be insecure in some specific situations. — M. Eriksson, Mar 19 '17 at 12:52
Thanks for your time. Now I get "Undefined index" error in both id_user and id_class — Nikos Kiriakakis, Mar 19 '17 at 12:53
How would a `WHERE` on in an `INSERT` query work? If you look at the OP's code, it should probably been an `UPDATE` and not a `INSERT`. — M. Eriksson, Mar 19 '17 at 12:56
edited to `UPDATE` @NikosKiriakakis is u get "Undefined index" u should probably check first is form is submited then use other code, because u get `$_POST['id_user']` from your form input `` — Mario, Mar 19 '17 at 13:01

PHP, query failed

1 Answers1