Click here to Skip to main content
15,612,584 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
Hi everyone! I have a problem in my code php and I dont why but happened

This is the problem:
Warning: mysqli_num_row expects parameter 1 to be mysqli_result, bool given on line 27

I Have something againts the SQL injetion in js

This is my code:


	header('location: home.php');

		die("No hay conexión: ".mysqli_connect_error());
	$query=mysqli_query($conn,"Select * from clini where name = '".$nombre."' and pass = '".$pass."'");
	$nr=mysqli_num_rows($query); HERE IS THE PROBLEM
	if($nr == 1)
		header("location: home.php");
	else if ($nr == 0)
		echo "<script>alert('Usuario no existe');window.location= 'login.php' </script>";

What I have tried:

I tried very thing, but nothing and I dont why happened, very thanks ;)
Updated 24-Nov-21 16:09pm
Richard Deeming 25-Nov-21 3:59am    
Quite apart from the SQL Injection vulnerability in your code - which, as Peter pointed out, is NOT prevented by Javascript - you are storing your users' passwords in plain text.

I hope you have extremely deep pockets, because you're going to have to pay a massive fine once your database is breached!

Fix your code to use properly parameterized queries, and fix your password storage.

PHP: SQL Injection - Manual[^]
PHP: Prepared statements and stored procedures - Manual[^]

Secure Password Authentication Explained Simply[^]
Salted Password Hashing - Doing it Right[^]

PHP: password_hash[^]
PHP: password_verify[^]
XEmmanuel21 25-Nov-21 10:25am    
Thanks, but I have some functions in Javascript so that they do not introduce strange data, or does it not work?

1 solution

$query is FALSE (a boolean) because the previous line failed, and you didn't check the return from mysqli_query

Also, your Javascript is not the place to defend against SQL injection. Anyone who can use the browser dev tools can easily bypass it.
Share this answer

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900