@mysql question & mysql_connect() error

[jawa]

I got Tim's secure login script found on this site. I'm cutting & dicing what I need (the prebuilt database functions saved me a bit of time). What I don't understand is the code below:

function db_query($qstring,$print=0) {
	global $sys_dbname;
	return @mysql($sys_dbname,$qstring);
}

It's called using

$sql = "SELECT * from TABLENAME;";
$result = db_query($sql);

The question I have is what exactly does '@mysql' do? Is it a synonym of mysql_query?

Also, I'm connecting to my database using:

function db_connect() {
	global $sys_dbhost,$sys_dbuser,$sys_dbpasswd;
	$conn = mysql_connect($sys_dbhost,$sys_dbuser,$sys_dbpasswd);
	if (!$conn) {
		echo mysql_error();
	}
	return $conn;
}

I have a user that I set up, but in my global variable '$sys_dbpasswd', I accidently put in the wrong password. I sent a delete command to the database using the query code above.

Here's the funny thing: I got a mysql_connect error for my set-up user, but it processed the delete command anyway. What user did it use to connect & process the delete command if the connect for my set-up user failed? How can I capture the user that last connected to my database?

Thanks in advance!
-J

[bpat1434]

First:
The @() is not a synonym. It actually supresses any errors that would be thrown by mySQL if the query fails or can't be done. So by using the @, you can check if there is a response (either by number of rows returned, or if the result is "true" or "false") and give a custom error message and still display your site, rather than having it break in multiple places.

Second:
The function seems to use a definitive variable set up by a "config" script. My guess is, the config script is included previously, and the function is calling the variables from the config.

So the function actually uses the "root" user you specify in the config file, and not the user you wanted to create. It processed the command because it didn't use the user you wanted. A little more explanation and some more code would help, as I can't give you THE answer you're looking for until I completely understand what's going on.

~Brett

[jawa]

1st Question:

If you notice, the code is @mysql, not @.

return @mysql($sys_dbname,$qstring); 

I understand the error suppression, I'm just not sure what the '@mysql' is. It has to be similar to mysql_query, but I can't find a thing on it. It's kind of hard to search on that term, because I get a lot of general mySQL information.

2nd Problem:

Let me post some more code, and hopefully it will become clear what problem I'm having.

Let me re-iterate the issue I'm having. I get a mysql_connect error, but the query is processed anyway. I need a way to find out what user is being used to connect to the database to complete the query.

On to the code...

I've got a page that has only a textarea & a submit button. This is where the sql will be entered. The submit takes it to a php page that connects to the database, & processes the query.

The first function is the connect function. It takes the host, user, & password & connects to the database. Nothing too out of the norm there.

The second function actually processes the query, in this case, "SELECT * from tablename".

$sys_dbhost    = 'localhost';
$sys_dbname    = 'db_name';
$sys_dbuser    = 'db_user';
$sys_dbpasswd  = 'db_password';

function db_connect() {
	global $sys_dbhost,$sys_dbuser,$sys_dbpasswd;
	$conn = mysql_connect($sys_dbhost,$sys_dbuser,$sys_dbpasswd);
	if (!$conn) {
		echo mysql_error();
	}
	return $conn;
}

function db_query($qstring,$print=0) {
	global $sys_dbname;
	return @mysql($sys_dbname,$qstring);
}

/* Performing SQL query */
$sql_from_form = $_POST["SQL"]; 
$query = stripslashes($sql_from_form);
$result = db_query($query);

The password in the php page was input INCORRECTLY. The database connection FAILED. I get an error stating this, however, I also get results from the query. Let me show you the results from the page:

Warning: mysql_connect() [function.mysql-connect]: Access denied for user: 'db_user@localhost' (Using password: YES) in c:\program files\apache group\apache\htdocs\poker\includes\do_query.php on line 30
Access denied for user: 'db_user@localhost' (Using password: YES)

user_id user_name ...
1 jawa ...

The fields user_id, user_name, etc is what is being returned from the select statement.

Hopefully this explains it a bit more. I'm getting a db connect error, but also getting results from my query.

I need to find out what user is being used to complete the query, even though the db_connect is erroring out.

Thanks,
-J

[jawa]

I found the first part of the problem.

mysql is an alias for mysql_db_query, which is now deprecated. I imagine that was part of my issue finding information about it.

The 2nd part of the issue is still UNRESOLVED.

Thanks,
-J

[bpat1434]

Here's what I don't understand:

if you are now using @(), when do you call the db_connect() function?

It seems to me your code should connect to the db, then query it. I'm not sure what user it's using (perhaps anonymous or root) but I don't know of any way to tell, other than look in your log files.

I would modify the db_query() function to look more like this:

$sys_dbhost    = 'localhost';
$sys_dbname    = 'db_name';
$sys_dbuser    = 'db_user';
$sys_dbpasswd  = 'db_password';

function db_connect() {
    global $sys_dbhost,$sys_dbuser,$sys_dbpasswd, $sys_dbname;
    $conn =  mysql_connect($sys_dbhost,$sys_dbuser,$sys_dbpassw
d);
    if (!$conn) {
        echo mysql_error();
    }
    mysql_select_db($sys_dbname, $conn);
    return $conn;
}

function db_query($qstring,$conn) {
    return @mysql_query($qstring, $conn);
}

/* Performing SQL query */
$sql_from_form = $_POST["SQL"]; 
$query = stripslashes($sql_from_form);
$conn = db_connect();
$result = db_query($query, $conn);

~Brett

[jawa]

The connect function is being called in a seperate file. I've got all my functions inside a dbfunctions.php page, and after the functions are read into memory, the connect call is at the bottom of the page. I forgot to copy it in.

Which log files are you referring to? I don't remember explicitly tell PHP or MySQL to log connections. If I need to start the logging process, how do I do that?

Thanks,
-J

[bpat1434]

Okay, now I understand it a little better. But I'm still not sure what's going on, or why your query is running. If you're still using that deprecated function (mysql()) don't. Use mysql_query(). I've never used mysql() before, but I'm guessing that in that function, if you fail to connect it tries as anonymous. And if it connects, it runs the query.

Quoted From: PHP Manual
If no such link is found, it will try to create one as if mysql_connect() was called with no arguments.

That's why it runs. So try changing the line where it says: @mysql() to:

@($qstring);

That should solve the problem.

~Brett