-2

I am trying to let to check the a table if there exists a value and if there exists a value it should output as JSON "one" and if it doesn't exist it should output "two". My thought is that With my SELECT EXIST Statement it should only return a row if there exists the value in the table but for some reason it always outputs a row.

Here is the code:

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}
if ($result = mysqli_query($conn, $query)) {

    $newArr = array();
    $value = mysqli_fetch_object($result);
    $newArr[] = (bool) $value->item_exists;

    echo json_encode($newArr); // get all products in json format.    
}
*/


/* part where output is just 1 or 0*/
$query = "SELECT EXISTS(SELECT * FROM wp_woocommerce_order_items WHERE order_id = $sdata)";
$myArray = array();
if ($result = mysqli_query($conn, $query)) {
    while($row = $result->fetch_row()) {
            $myArray[] = $row;
    }
    // 2nd operation checkif order available
 if ($conn->affected_rows == 1) {
    echo json_encode($one);
 } else {
    //Success and return new id
    echo json_encode($two);
 }    
    //end 2nd operation
    echo json_encode($myArray);
}$result->close();
    echo json_encode($newArr); // get all products in json format.    
}
    $conn->close();
?>
sanduniYW
  • 723
  • 11
  • 19
getNordic
  • 57
  • 1
  • 7

2 Answers2

1

Could you not simply try something like the following? Assign an alias to the result of the query so you can access it like you would for a regular column name, run the query and extract that pseudo-columnname from the recordset. This does, of course, ignore the sql vulnerability ( or potential vulnerability ) in the sql statement - a prepared statement would be a safer method to employ.

$query = "select exists( select * from `wp_woocommerce_order_items` where `order_id` = $sdata ) as `exists`";

$exists = false;

if( $result = mysqli_query( $conn, $query ) ) {
    $row = $result->fetch_assoc();
    $exists = intval( $row['exists'] );
}

$myArray = array( $exists ? 1 : 2 );
echo json_encode($myArray);

To do similar using a prepared statement you might consider something like this:

$exists = false;

$sql='select exists( select * from `wp_woocommerce_order_items` where `order_id` = ? ) as `exists`';
$stmt=$conn->prepare($sql);
if( $stmt ){
    $stmt->bind_param( 'i', $sdata );
    $res=$stmt->execute();

    if( $res ){
        $stmt->store_result();
        $stmt->bind_result( $exists );
        $stmt->fetch();
        $stmt->free_result();
        $stmt->close();
    }
}


$myArray = array( $exists ? 1 : 2 );
echo json_encode( $myArray );
Professor Abronsius
  • 33,063
  • 5
  • 32
  • 46
1

Please always use PDO or Prepared MySQLI to avoid SQL injections.
Someone could drop your tables or do other dangerous things that will ruin your data.

Refer to this example:

<?php

    $conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $dbpassword);
    $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

    $stmt = $conn->prepare("SELECT 1 FROM `wp_woocommerce_order_items WHERE order_id = :sdata");
    $stmt->execute(['sdata' => $sdata]);
    $result = $stmt->fetchColumn();

    $exists = $result ? "one" : "two";

    print_r($exists);
Your Common Sense
  • 156,878
  • 40
  • 214
  • 345
Thrallix
  • 699
  • 5
  • 20