php registration working but also error message

Question

1.00/5 (1 vote)

See more:

Hi Guys
My registration page working but along with successful message , i am getting this notice message. Please guide me.

Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given in C:\xampp\htdocs\test\register.php on line 41
You have successfully Registered

PHP

<?
//Database Information

$dbhost = ;
$dbname = ;;
$dbuser = ;;
$dbpass = ;;

//Connect to database

mysql_connect ( $dbhost, $dbuser, $dbpass)or die("Could not connect: ".mysql_error());
mysql_select_db($dbname) or die(mysql_error());


print_r($_POST);

//email is user id
                $utype = $_POST['user_type'];
              $user_email   = $_POST['user_email'];
        $pwd                = $_POST['password'];
        $pwd2               = $_POST['password2'];
        $fname              = $_POST['first_name'];
        $lname          = $_POST['last_name'];
        $dob                = $_POST['DOB'];
                $sex              = $_POST['sex'];
                $country_origin                             = $_POST['country_origin'];
                $mobile                                 = $_POST['mobile'];
                $streetname_no                              = $_POST['streetname_number'];
        $suburb                                             = $_POST['suburb'];
        $postcode                                           = $_POST['post_code'];
        $how_hear                                           = $_POST['how_you_heard_globall'];
            $footy_before                                   = $_POST['footy_Cricket_before'];
                $afl_support                                = $_POST['afl_you_support'];
                $lenght_stay_aus                            = $_POST['lenght_stay_australia'];
                $interested_club                            = $_POST['interested_in_future_club'];
                $spl_need                                       = $_POST['any_special_need'];


$checkuser = mysql_query("SELECT email FROM customer WHERE user_email='$user_email'");

$username_exist = mysql_num_rows($checkuser);

if($username_exist > 0){
    echo "This email account already register. Please try another.";
    unset($user_email);
    //include 'register.html';
    exit();
}

$query = "INSERT INTO customer (user_type, user_email, password, first_name, last_name, DOB, sex, country_origin, mobile, streetname_number, suburb, post_code, how_you_heard_globall, footy_Cricket_before, afl_you_support, lenght_stay_australia, interested_in_future_club, any_special_need)
VALUES('$utype', '$user_email', '$pwd', '$fname', '$lname', '$dob', '$sex', '$country_origin', '$mobile', '$streetname_no', '$suburb', '$postcode', '$how_hear', '$footy_before', '$afl_support', '$lenght_stay_aus', '$interested_club', '$spl_need')";
mysql_query($query) or die(mysql_error());
mysql_close();

echo "You have successfully Registered";
?>

Posted 29-Mar-12 1:21am

Peta2010

Add a Solution

Comments

Henning Dieterichs 29-Mar-12 7:36am

CAUTION: Your code is vulnerable to SQL-Injection (see here: http://en.wikipedia.org/wiki/SQL_injection) attacts!

3 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Henning Dieterichs · Accepted Answer · 2012-03-29T01:41:00

Solution 1

The warning is shown, because $checkuser is not a resource as it should be but a boolean.
According to the PHP-Manual, a boolean (false) is returned if the query fails.
You should do some error-handling:

PHP

[...]
$checkuser = mysql_query("SELECT email FROM customer WHERE user_email='$user_email'");

if (!$result) {
    $message  = 'Invalid Query: ' . mysql_error() . "\n";
    $message .= 'Whole Query: ' . $query;
    die($message);
}
[...]

And is I commented above, your code is vulnerable for SQL-Injection attacks.

Posted 29-Mar-12 1:41am

Henning Dieterichs

Comments

Peta2010 29-Mar-12 7:52am

I don't understand, could you please write what actual i need to write ?

Henning Dieterichs 29-Mar-12 8:07am

You have to check for errors. If an error occur, you have to display it (and only then you can fix it).

Otherwise you get something like "expects parameter 1 to be resource", and you won't get the real error message. The solution you accepted says the same but guesses the error. Don't guess - display the error!

For SQL-Injection read the wiki-article I've linked. If you don't want to read, tell me the URL of your script and you will experience what SQL-Injection is ;)

Peta2010 29-Mar-12 8:18am

ok where is your wiki article?

Henning Dieterichs 29-Mar-12 8:34am

http://en.wikipedia.org/wiki/SQL_injection

Loke.mysore · Accepted Answer · 2012-03-29T01:51:00

Solution 2

Up to my knowledge there might be some error in select query,
if error is there it will return false which is not greater than 0 which you are comparing, so it will proceed forward and execute.

$checkuser = mysql_query("SELECT email FROM customer WHERE user_email='$user_email'");

check the email and user_email

Posted 29-Mar-12 1:51am

Loke.mysore

Comments

Peta2010 29-Mar-12 7:59am

thanks its ok now. Anyone suggest me As mentioned above this code is vulnerable to php injection so how can i protect this? what modification i need to do? So my page working now i am going to work on validations.

Loke.mysore · Accepted Answer · 2012-03-29T02:15:00

use mysql_errno() function to check errors of all queries it returns 0 if success else some error code, with this u can validate or print the error messages mysql_error().

and you can decide whether the errors should be displayed or not.

<pre lang="PHP">$displayErrors = true;
if ($displayErrors) {
  if (mysql_errno > 0) {
    echo mysql_error();
  }
}

php registration working but also error message

3 solutions

Solution 1

Solution 2

Solution 3

Add your solution here

Preview 0

Existing Members

...or Join us