php error, mysql db

[kumarb]

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/mahahind/public_html/admin.php on line 11

Warning: Cannot modify header information - headers already sent by (output started at /home/mahahind/public_html/admin.php:11) in /home/mahahind/public_html/admin.php on line 18

page code is
<?php
session_start();
include('connect.php');
$loginid=$POST['loginid'];
$pass=$POST['password'];

$query="select * from registration where loginid='$loginid' and password='$pass'";
$res=mysql_query($query);
$num=mysql_num_rows($res);
if($num==1)
{
$_SESSION['name']=$loginid;
header('Location:home.php?succ=1');
}
else
{
header('Location:index.html');
}

?>

please help

---

connect.php (code)

<?php
$con=mysql_connect("localhost","mahahind_root","") ;

if(!$con)
{
die("Could not connect database");
}
mysql_select_db("mahahindustan");

?>

please help

[__berfuzz]

$res=mysql_query($query);
$num=mysql_num_rows($res); //Why $res ??? try $query

The header. I guess you have some output before the header.

[kumarb]

it working fine with localhost on my machine

but when uploaded to linux hosting ( database created with mysql cpanel)
its giving error

[laserlight]

$num=mysql_num_rows($res); //Why $res ??? try $query

$res is correct.

This warning message:

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/mahahind/public_html/admin.php on line 11

is a result of one or more of these three:
1. Failed to connect to database server.
2. Failed to select the database.
3. Failed to execute corresponding SQL statement.

This warning message:

Warning: Cannot modify header information - headers already sent by (output started at /home/mahahind/public_html/admin.php:11) in /home/mahahind/public_html/admin.php on line 18

is a result of sending output before things like header(), setcookie() and session_start(). This output could be some text, some HTML markup, or even an error message emitted by the PHP interpreter.

So, I suspect that if you fix the first problem, the second will disappear. Now, in connect.php the connection to the database server is setup and should exit with an error message if it fails, so we can rule out #1 as we did not get such an error message. The database is selected, so #2 is unlikely. That leaves #3, which could be due to a failure to setup the database table correctly, or due to SQL injection since you did not validate the incoming variables and/or use mysql_real_escape_string().

[kumarb]

code i got on cpanel after creating the database and user; is as following

PHP $dbh=mysql_connect ("localhost", "mahahind_root", "<PASSWORD HERE>") or die ('I cannot connect to the database because: ' . mysql_error());
mysql_select_db ("mahahind_mahahindustan");

how do i confirm this connection has been made and working fine .

[mina_gabriel84]

the code is okaycheck your database

[kumarb]

how do i check database, could you please help me out

---

-- phpMyAdmin SQL Dump
-- version 2.9.2

-- http://www.phpmyadmin.net

-- Host: localhost
-- Generation Time: Mar 29, 2008 at 10:47 AM
-- Server version: 5.0.27

-- PHP Version: 5.2.1

-- Database: mahahind_mahahindustan

---

--

-- Table structure for table admin_login

CREATE TABLE admin_login (
a_username text NOT NULL,
a_password text NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=latin1;

--

-- Dumping data for table admin_login

INSERT INTO admin_login (a_username, a_password) VALUES
('maha', 'maha');

---

--

-- Table structure for table join_us

CREATE TABLE join_us (
j_id int(30) NOT NULL auto_increment,
con_fname text NOT NULL,
con_sname text NOT NULL,
con_fr_name text NOT NULL,
con_sr_name text NOT NULL,
con_dob text NOT NULL,
con_bgroup text NOT NULL,
con_locality text NOT NULL,
con_city text NOT NULL,
con_state text NOT NULL,
con_pincode int(30) NOT NULL,
con_rphone int(30) NOT NULL,
con_ophone int(30) NOT NULL,
con_mobile int(30) NOT NULL,
con_pan_no int(30) NOT NULL,
con_email text NOT NULL,
con_conslt text NOT NULL,
con_id_no int(30) NOT NULL,
nom_fname text NOT NULL,
nom_sname text NOT NULL,
nom_relation text NOT NULL,
nom_dob text NOT NULL,
spo_id_no int(30) NOT NULL,
spo_fname text NOT NULL,
spo_sname text NOT NULL,
spo_dd_no int(30) NOT NULL,
spo_date text NOT NULL,
spo_bank_name text NOT NULL,
PRIMARY KEY (j_id)
) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=12 ;

--

-- Dumping data for table join_us

INSERT INTO join_us (j_id, con_fname, con_sname, con_fr_name, con_sr_name, con_dob, con_bgroup, con_locality, con_city, con_state, con_pincode, con_rphone, con_ophone, con_mobile, con_pan_no, con_email, con_conslt, con_id_no, nom_fname, nom_sname, nom_relation, nom_dob, spo_id_no, spo_fname, spo_sname, spo_dd_no, spo_date, spo_bank_name) VALUES
(2, 'pravin', 'yadav', 'vitthal', 'yadav', '', 'AB+', 'Malegaon', 'baramati', 'maharastra', 413115, 255260, 255260, 2147483647, 34675, '[e-mail]', 'yes', 2345, 'sachin', 'kadam', 'friend', '', 6879, 'vishal', 'shinde', 345, '12-4-2008', 'state bank'),
(3, 'mahesh', 'mandage', 'pandurang', 'mandage', '', 'o+', 'katewadi', 'baramati', 'maharastra', 413118, 234071, 234071, 2147483647, 6567, '[e-mail]', 'yes', 789, 'sunil', 'vare', 'friend', '', 5768, 'ranjit', 'kshisagar', 7890, '13-2-2008', 'bombay bank'),
(4, 'kishor', 'kale', 'shashikant', 'kale', '26-12-1985', 'a+', 'baramati', 'baramati', 'maharastra', 413102, 456565, 4565677, 997087365, 876, '[e-mail]', 'yes', 87, 'kiran', 'gole', 'friend', '12-8-1984', 676, 'pravin', 'yadav', 766, '26-12-1985', 'maharastra bank'),
(5, 'g', 'g', 'g', 'g', '4-8-1987', 'a', 'g', 'g', 'g', 1, 1, 1, 1, 1, 'g', 'yes', 1, 'g', 'g', 'g', '6-4-1983', 1, 'g', 'g', 1, '4-8-1987', 'g'),
(6, 'g', 'g', 'g', 'g', '4-8-1987', 'a', 'g', 'g', 'g', 1, 1, 1, 1, 1, 'g', 'yes', 1, 'g', 'g', 'g', '6-4-1983', 1, 'g', 'g', 1, '4-8-1987', 'g'),
(7, 'r', 'r', 'r', 'r', '2-6-01', 'r', 'r', 'r', 'r', 2, 2, 2, 2, 2, '[e-mail]', 'no', 2, 'r', 'r', 'r', '1-8-03', 2, 'r4', 'r', 2, '2-6-01', 'r'),
(8, 'd', 'd', 'd', 'd', '4-07-09', 'g', 'd', 'd', 'd', 4, 4, 4, 4, 4, 'd', 'yes', 4, 'd', 'd', 'd', '6-8-09', 4, 'd', 'd', 4, '4-07-09', 'd'),
(9, 'sham', 'raje', 'ii', 'ooo', '1-2-01', 's', 'i', 'j', 'm', 999, 88, 888, 888, 888, '[e-mail]', 'n', 99, 'u', 'u', 'h', '2-1-03', 88, 'h', 'i', 11, '1-2-01', 'ii'),
(10, 'W', 'U', 'U', 'U', '1-1-08', 'I', 'I', 'J', 'J', 99, 9, 0, 9, 9, '[e-mail]', 'N', 0, 'QQ', 'Q', 'Q', '1-1-08', 11, 'QQ', 'Q', 1, '1-1-08', 'B'),
(11, 'RAM', 'NAGARGOJE', 'H', 'H', '28-09-1979', 'LEFT', 'I', 'I', 'I', 0, 7, 7, 9, 9, '[e-mail]', 'I', 888, 'J', 'J', 'J', '2-1-03', 99, 'I', 'O', 9, '28-09-1979', 'm');

---

--

-- Table structure for table registration

CREATE TABLE registration (
r_id int(30) NOT NULL auto_increment,
fname text NOT NULL,
lname text NOT NULL,
address text NOT NULL,
emailid text NOT NULL,
contact int(30) NOT NULL,
loginid text NOT NULL,
password text NOT NULL,
PRIMARY KEY (r_id)
) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=9 ;

--

-- Dumping data for table registration

INSERT INTO registration (r_id, fname, lname, address, emailid, contact, loginid, password) VALUES
(1, 'pravin', 'yadav', 'baramati', '[e-mail]', 2147483647, 'pravin', 'yadav'),
(2, 'ggg', 'ffff', 'ddd', '[e-mail]', 666666, 'yogesh', 'raje'),
(3, 'rakesh', 'SHARMA', 'BARAMATI', '[e-mail]', 2147483647, 'rakesh', 'rakesh'),
(4, 'h', 'H', 'H', '[e-mail]', 6, 'h', 'h'),
(5, 'aadi', 'raje', 'pune', '[e-mail]', 333, 'aadi', 'aadi'),
(6, 'nilu', 'nilu', 'shikrapur', '[e-mail]', 222, 'nilu', 'nliu'),
(7, 'yogeshnilesh', 'soundore', 'shrirampur', '[e-mail]', 2147483647, 'yogeshnilesh', 'yogeshnilesh'),
(8, 'sham', 'RAJE', 'NAGAr', '[e-mail]', 222, 'sham', 'sham');

[laserlight]

It turns out that my analysis was both right and wrong. The problem is indeed #3, but it is due to the SQL statement itself being incorrect, not because of an SQL injection or mismatch with the database table. PASSWORD() is a function in the MySQL dialect of SQL, so it is reserved. As such, your query should be:

$query="select * from registration where loginid='$loginid' and `password`='$pass'";

However, while this may fix the current problem, it remains an incomplete fix. For completeness, you would need to check with [man]isset[/man] or [man]empty[/man] that $POST['loginid'] and $POST['password'] exist before assigning them to $loginid and $pass. When you do assign them, you should use [man]mysql_real_escape_string/man to avoid SQL injection.

[mina_gabriel84]

look al you have to do is to check the selection
connect.php (code)
)

<?php
$con=mysql_connect("localhost","mahahind_root","") ;

if(!$con)
{
die("Could not connect database");
}
$select=mysql_select_db("mahahindustan");
if(!$select){
die("could not select the db" . mysql_error());
}

?>
check if your script select the database or not
do the same with $query

[laserlight]

I doubled checked, and my assumption that MySQL would choke on password is wrong.

Yes, I agree that you should check the problem with [man]mysql_error/man. However, note that my point about SQL injection still stands.

mina_gabriel84, kindly post your PHP code in php bbcode tags.

[kumarb]

thanks both your guys, i will surely try to repair it in night.

thanks for info