Bad foreach array loop - what am I not seeing?

[Capoeirista]

Hi There -

This is a portion of a login page that is supposed to test whether someone has been locked out of the system. Supposed to retrieve data from the database and see whether the locked flag is set to 'n' or 'y'. With each try, the variable $locked_num is incremented. After three tries, they're locked out of the sytem by changing the locked_flag to 'y'.

---

• I've tested the connection and it's good.
• When the tests are applied, there is no value for the $locked_flag variable.

---

My page renders the following in the browser:

Notice: Use of undefined constant y - assumed 'y' in /...cust_login.php on line 157
The value of locked_flag =
The value of locked_num = 1
Warning: Invalid argument supplied for foreach() in ...cust_login.php on line 168

---

There's something wrong with the way I'm processing the returned data. I'm not sure whether it's my SQL statement, or the handling of the returned array. I've hunted all over my notes, and I'm not sure what I'm doing wrong.

Here's the code:

---

/***** TEST WHETHER CUSTOMER IS LOCKED OUT, INITIALIZE AND REGISTER VARIABLES **/

// INITIALIZE VARIABLES

$locked_num = 1;


// CONNECTION

include("includes/connect2db.php");


// QUERY STRING - GET VALUE OF locked_flag FROM DATABASE

$sqlString="SELECT * from customer where cust_Lname ='$cust_Lname';";


// PROCESS RESULTS

$result			= mysql_query($sqlString,$con)		;
$row 			= mysql_fetch_assoc ($result)		;
$locked_flag 	= ($row["locked_flag"])				;


// IS CUSTOMER LOCKED OUT ALREADY?

if ($locked_flag == y)
	$locked_num = 4;

session_register("$locked_num");
session_register("$locked_flag");


// TEST

echo "The value of locked_flag = $locked_flag <br>";
echo "The value of locked_num = $locked_num";

foreach ( $row as $key => $value) {
	echo "Key: $key, Value: $value";
	}

  }

[rincewind456]

Notice: Use of undefined constant y - assumed 'y' in /...cust_login.php on line 157

This is caused because you have missed the quote marks form around the y on this line

if ($locked_flag == y)

Warning: Invalid argument supplied for foreach() in ...cust_login.php on line 168

This is usually caused because you have no result from the sql query, you need to add some error checking to see if the sql query is returning a result.

[Capoeirista]

Hi again - and thanks. You're really great to help me again.

Fixed the lacking quotes. Thanks.

As for the test, that's what I thought I was doing in the test section. The value of locked_flag shows up as null, even if I initialize it to zero. That's why I put in the foreach loop, to see if the other data in the row would show up. I'm sort of inventing the test procedure as I go along. I don't know whether this is normal or good coding practice.

I know that the connection is good because when I actually input valid or invalid entries into the textfields, I get appropriate data back from the database. But that's a different query. (Identical, actually, but a different one.)

I admit to utter confusion when it comes to quotes in php-mysql queries. Also, the dot thing - when to use and when not to use. When my teacher writes these on the board, he doesn't pay attention to quotes. I think the whole class is a bit baffled. I've tried to search for this, but the manual isn't talking about it. Sort of like when the manual wouldn't talk about "=>" . I'm sure it's in there, but it's hard to search for.

I'd like to be able to make effective tests for everything I write. Any advice you could give would be gratefully accepted.

Thanks,

Lee

[rincewind456]

In your process results you're not :
a. Checking for a failure of the query with something like

 $result = mysql_query($sqlString,$con) or die(mysql_error('Query failed for this query:'.$sqlString)); 

b. Checking to see if

$row['locked_flag']

is empty, even if a result is returned from the DB.

As for quotes for query strings, single quotes are supposedly faster than double quotes, how much benefit you get from one query is most probably negligible. So you can use either, but it is best to be consistent in your usage of them. For your query you could write it the way you have or like this

$sqlString='SELECT * from customer where cust_Lname =\''.$cust_Lname.'\';'; 

in which case you use the dot thingy more commonly known as a concatenater take a look here for an explanation.

[Capoeirista]

Thanks for your reply. I hope I entertain rather than exasperate. I am most appreciative of your assistance.

In the general idea of testing, is it that I should do some kind of test after everything? For example, should I have this page echo $locked_flag immediately after I define it?

When I did, I got null.

Then I copied your select statement. Still got null.

In the connection include, I check for connection like this:

<?PHP

$con=mysql_connect("localhost:8888","root","root")
or die("Err:con");

$rs=mysql_select_db("project",$con)
or die("Err:DB");
 ?>

So if the connection's bad, it should tell me.

It also plays nice with other pages in the app.

My question for dot concatenators is that I don't understand when you use them with the select statement. I've seen single uses of quotes, nested quotes, single quotes. I've been told that MySQL doesn't like single quotes, only double quotes. Some have dots and some don't.

In your example, do you mean that if you nest quotes, you should use the dots?

Thanks again for your help. I really hope something great happens to you this weekend,

Lee

[rincewind456]

In your example, do you mean that if you nest quotes, you should use the dots?

If your using double quotes then there is no need to use the dot concatenator, because the contents of the variable will expand correctly, see Strings for examples and further explanations. However if you use the single quote way of building your queries then you will be breaking you query down into separate pieces, and will then have to use the concatenator to join all the pieces together. I personally use the [man]sprintf/man function to build my queries where possible.

As for error checking, there is no need that I can see for checking a variable straight after defining it, however if you are going to use input from a user or output from a database then you must check to see if: a. You have received input and it is the type you want.
b. Ensure that the database has actually returned a result.

In your case you aren't checking to see if you are receiving anything from the database, yet you are relying on it being returned.
So if it isn't returned then your script fails.

So whilst your building the script it is a good idea to echo out the results of your database query, just to be sure that you are getting the results you think you are, but in the long run you will have to build in some form of error catching just in case there is no result from the database.

The way I would do it, probably not the best is like this

// PROCESS RESULTS
$locked_flag ='n';		//Set the variable to no as default

$result            = mysql_query($sqlString,$con)        ;
$row             = mysql_fetch_object($result)        ;

if($row->locked_flag == 'y') {
	$locked_flag ='y';
}

And unless you are using the query somewher else or expecting more than one result (which you shouldn't be), I would change the query to

$sqlString="SELECT locked_flag 
FROM customer 
WHERE cust_Lname ='$cust_Lname' 
LIMIT 1;";

[Capoeirista]

Been out of town and couldn't get to this until now. I know it's a bit delayed, but I'm way grateful that you answered this. It's one of those things that I hope will become second nature in a short time. (like tomorrow.)

I really appreciate your kindness and patience in explaining all of this. I hope that something truly wonderful happens to you this week.