MySQL query no results

Question

I want echo my DB results from Session but i get no results or errors:

  $_SESSION['username'];

  $link = mysqli_connect("$myHost", "$myUser", "$myPass", "$myDB");

    // Check connection
    if($link === false){
        die("ERROR: Could not connect. " . mysqli_connect_error());
    }


    $username = mysqli_real_escape_string($link, $_SESSION['username']);


   $sql = "SELECT * FROM users where username = $username";
    $result = mysqli_query($link, $sql);

    echo $result;

Anyone know why not? Session works.

Thanks

Select query should be like this : `SELECT field1, field2,...fieldN FROM table_name [WHERE Clause]` — NID, Sep 14 '18 at 11:29
also in connection you are passing variable within quote which will behave like constant so in place of db name it will pass `$myDB` not its value — Exterminator, Sep 14 '18 at 11:38
Possible duplicate of [How can I prevent SQL injection in PHP?](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — Progman, Sep 14 '18 at 11:45
Note that `mysqli_real_escape_string` not not safe to use without setting the defualt charset it's in the manual...A better option to protect against SQL injections is using prepared statements. — Raymond Nijland, Sep 14 '18 at 12:03

MorganFreeFarm · Accepted Answer · 2018-09-14T12:10:14.903

1

You should change your query, like this:

$sql = "SELECT user FROM yourtablename WHERE username = $username"

Where "user" is what you want to SELECT if you want to select all data, you can use "*", yourtablename is table name of table you want to select.

After your edits, your code should look like

  $_SESSION['username'];

  $link = mysqli_connect("$myHost", "$myUser", "$myPass", "$myDB");

    // Check connection
    if($link === false){
        die("ERROR: Could not connect. " . mysqli_connect_error());
    }


    $username = mysqli_real_escape_string($link, $_SESSION['username']);


   $sql = "SELECT * FROM users where username = $username";
    if ($result = $link->query($sql)) {

        while ($row = $result->fetch_row()) {
            var_dump($row);
        }

        $result->close();
    }

More info here

Notice: mysqli_real_escape_string it's not very security. A better option to protect against SQL injections is using prepared statements, more info here

edited Sep 14 '18 at 12:10

answered Sep 14 '18 at 11:33

MorganFreeFarm

3,811
8
23
46

Updated my Question, but the same problem. Can you check it please? – sarahlo Sep 14 '18 at 11:37
Now i get this error: `Warning: mysqli::query(): Empty query in ` – sarahlo Sep 14 '18 at 11:52
My bad use `$sql` instead of `$query` cuz your variable which contains sql query is with name `$sql` also, why you have `$_SESSION['username'];` in the begining ? i think it should be `session_start()` – MorganFreeFarm Sep 14 '18 at 11:54
With `var_dump()` you can see the result - yes. Can you write `var_dump($username)` before `$sql = ....` row ? – MorganFreeFarm Sep 14 '18 at 12:00
Note that `mysqli_real_escape_string` not not safe to use without setting the defualt charset it's in the manual...A better option to protect against SQL injections is using prepared statements. – Raymond Nijland Sep 14 '18 at 12:03
@sarahlo where was your bad at the end ? – MorganFreeFarm Sep 14 '18 at 12:08
@RaymondNijland Yes, i will add this to my answer – MorganFreeFarm Sep 14 '18 at 12:08

MySQL query no results

1 Answers1