-1

I'm encountering a problem with this object. I don't know (if it is possible), how to get the value of COUNT(id).

I tried $req[0]->COUNT(id) but "COUNT()" it detected it as a function. How could it be detect as a key?

Here's a var_dump($req):

object(stdClass)[4]
public 'COUNT(id)' => string '1' (length=1)

PHP

$req = $db->query('SELECT COUNT(id) FROM `users` WHERE username ="'.$username.'" AND password = "'.$password.'"');

if($req == 1){
 $_SESSION['authentificated'] = true;
 $_SESSION['username'] = $username;
}

var_dump($req); 

The output of the query should be 0 or 1 if the user is already register or not.

user3783243
  • 5,368
  • 5
  • 22
  • 41
Arthur
  • 11
  • 2
  • 1
    You could alias the count - `SELECT COUNT(id) as userCount FROM users` then reference it as `$req[0]->userCount` – Aaron W. Apr 19 '19 at 12:00
  • 1
    Dont write queries like that. Parameterize. Don't store plain text passwords, hash. – user3783243 Apr 19 '19 at 12:03
  • i dont undrestand why u check on the count, you can simply check if there is a user with given username and password – A.Marwan Apr 19 '19 at 12:03
  • [how-can-i-store-my-users-passwords-safely](https://stackoverflow.com/questions/1581610/how-can-i-store-my-users-passwords-safely) – Paul Spiegel Apr 19 '19 at 12:14
  • [how-can-i-prevent-sql-injection-in-php](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) – Paul Spiegel Apr 19 '19 at 12:15

4 Answers4

3

1.You need to add alias for COUNT()

2.After query execution you need to fetch record and then do the comparison

Do like below:-

$req = $db->query('SELECT COUNT(id) as count FROM `users` WHERE username ="'.$username.'" AND password = "'.$password.'"');

$result = mysqli_fetch_assoc($req); // sample example,you need to change accordingly
if($result['count'] == 1){
  //your code

}

Note:-

Saving plain password is very bad idea. so use password hashing

Your current code is wide-open for SQL INJECTION. To prevent from it use prepared statements

mysqli::prepare

PDO::prepare

I will do it something like this: https://3v4l.org/YOBGX

Alive to die - Anant
  • 70,531
  • 10
  • 51
  • 98
0

Here alias required or else it won't capture that count value the way you want.

$req = $db->query('SELECT COUNT(id) cnt FROM `users` WHERE username ="'.$username.'" AND password = "'.$password.'"');


var_dump($req); 
Rahul
  • 18,271
  • 7
  • 41
  • 60
0

Here is the solution you have not bind the key for that please see below

 $req = $db->query('SELECT COUNT(id) as user_exists FROM `users` WHERE username 
="'.$username.'" AND password = "'.$password.'"');

if($req == 1){
    $_SESSION['authentificated'] = true;
    $_SESSION['username'] = $username;
}

var_dump($req); 
Varun Malhotra
  • 1,202
  • 3
  • 15
  • 28
0

Try this --

 $req = mysqli_query($db,'SELECT (COUNT(id)) as countID FROM `users` WHERE username ="'.$username.'" AND password = "'.$password.'"'));
        $row = mysqli_fetch_array($req);
        $countID = $row['countID'];
        if($countID == 1){
         $_SESSION['authentificated'] = true;
         $_SESSION['username'] = $username;
        }

        var_dump($req);
SAVe
  • 814
  • 6
  • 22