Question

[UPDATED] with new code “sql_real_escape_string()”
[UPDATED] if anyone wants to look at the site its at Test site
[UPDATED] with the while code showing any results via echo

Hello All,

I have looked at many posts on this matter, but simply cannot understand why the following code doesn’t work:

    $username = $_POST['username'];

    // get the record of the user, by looking up username in the database.  
    $query = sprintf("SELECT UserName, Password FROM userlogin WHERE UserName='%s'", mysql_real_escape_string($username));

    $result = mysqli_query($dbc, $query) or 
        die ("Error Querying Database for: " . $query . 
        "<br />Error Details: " . mysql_error() . "<br/>" . $result);

while ($row = mysqli_fetch_assoc($result))
{
         Echo($row['UserName']);
}

The Code seems to be correct… the database is working perfectly (for input purposes) and the connection is a shared connection applied with require_once(‘databaseconnection.php’); that is working for the registration side of things.

like normal I’m sure this is something simple that I have overlooked but cannot for the life of me see it!

I do not get any error messages from the myssql_error() its simply blank.

any help would be much appreciated.

Regards

Answer 1

Check the username you try to query as it might be empty. Do you really use a post-request to run that script? How do you verify that it does not work? What do you do with $data after the query?

If just nothing seems to happen it is likely your query did not match any record. Check for whitespace and case of the username you are looking for.

Mind those warnings:

• Use a prepared statement or at least sql-escape any user-input before using it in sql.
• Don’t use die in serious code only for debugging.