-2

This is my code:

<?php
session_start();
include_once 'dbconnect.php';

if(!isset($_SESSION['user']))
 {
 header("Location: index.php");
 }
 $res=mysql_query("SELECT * FROM suppliers WHERE user_id=".$_SESSION['user']);
$userRow=mysql_fetch_array($res);
?>

The error occurred after I introduced a trigger to my table suppliers and changed the user_id from int to varchar such that instead of being 1 or 3 now it is SUPL001, when a I log in with wrong credentials it accepts and displays the error above. The page does not echo the name of the user on the header link

tomtomssi
  • 1,017
  • 5
  • 20
  • 33
musyimi
  • 19
  • 8
  • 1
    Please don't use `mysql_*` function, use `mysqli` or `PDO` instead ! – Thomas Rollet Feb 29 '16 at 08:07
  • You haven't wrapped your input in `'` as you need to do when you use varchar. – Epodax Feb 29 '16 at 08:07
  • Possible duplicate of [mysql\_fetch\_array()/mysql\_fetch\_assoc()/mysql\_fetch\_row() expects parameter 1 to be resource or mysqli\_result, boolean given](http://stackoverflow.com/questions/2973202/mysql-fetch-array-mysql-fetch-assoc-mysql-fetch-row-expects-parameter-1-to) – Chetan Ameta Feb 29 '16 at 08:08
  • `print_r($_SESSION);` check what r u getting in session – devpro Feb 29 '16 at 08:09

2 Answers2

1

If your user id is string as you mentioned "SUPL001" than you need to use quotes around user id as:

$res = mysql_query("SELECT * FROM suppliers WHERE user_id = '".$_SESSION['user']."'");

Side Note:

Stop using mysql_* its deprecated and close in PHP 7, use mysqli_* or PDO.

devpro
  • 16,184
  • 3
  • 27
  • 38
0

Use mysqli, mysql_* has been decapitated.

Also, please make sure that you escape the user in the user session. (SQL injection)

session_start();

// --- new connect, would be in dbconnect.php
$link = mysqli_connect("localhost", "my_user", "my_password", "world");

if (mysqli_connect_errno()) {
    printf("Connect failed: %s\n", mysqli_connect_error());
    exit();
}
// ---



if(!isset($_SESSION['user'])) {
    header("Location: index.php");
}


/* Select queries return a resultset */
if ($result = mysqli_query($link, "SELECT * FROM suppliers WHERE user_id = '".$_SESSION['user']."'")) {
    printf("Select returned %d rows.\n", mysqli_num_rows($result));

    /* free result set */
    mysqli_free_result($result);
}



mysqli_close($link);
arc
  • 4,553
  • 5
  • 34
  • 43