I'm creating a Contact Us page that has a form users may use to send a message.
I've run into an issue and I have never seen this error before. Could anyone help explain how to fix this please?

Catchable fatal error: Object of class stdClass could not be converted to string in /homepages/30/d354929366/htdocs/contact.php on line 13

Line 13 is:

$contactsql = "SELECT * FROM users WHERE username='$username'";

<?php
include("inc/config.php");
include_once("inc/functions.php");

$ip = $_SERVER['REMOTE_ADDR'];

$username = $_SESSION['customer'];
$submit = (isset($_POST['submit']));
$to = "myemail@gmail.com";
$subject = "New Contact!";

    $contactsql = "SELECT * FROM users WHERE username='$username'";

$result = mysql_query($contactsql);
$row = mysql_fetch_assoc($result);

$userid = $row['userid'];
$name = $row['name']; 
$email = $row['email'];
$username = $row['username'];

if($submit){

if(!isset($_SESSION['customer'])){

$getusername = mysql_query("SELECT username FROM users WHERE email='$email'");
$getrow = mysql_fetch_assoc($getusername);

$username = $getrow['username'];
}


$answered = 0;
$date = date("Y-m-d");
$name = mysql_safe($_POST["name"]);
$email = mysql_safe($_POST["email"]);
$message = mysql_safe($_POST["comments"]);

$name = $name;
$email = $email;

if($name){
	if($email){
		if($comments){

		$success = "<div id='contsuccess'>We have received your message!</div>";

		$newcontquery = "INSERT INTO contact VALUES ('','$userid','$username','$name','$email','$message','$answered','$date')";
			mysql_query($newcontquery);

		mail("$to", "$subject", "My Site Title","From: admin@mysite.com");

	}
	else{
		$error = "<div id='conterror'>Please type a question or comment!</div>";
	}

}
else{
	$error = "<div id='conterror'>Type in your Email!</div>";
}
}
else{
	$error = "<div id='conterror'>Type in your Name!</div>";
}

}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
    <meta http-equiv="Content-Language" content="en" />
    <meta http-equiv="Content-Type" content="text/html; charset=windows-1251" />
    <title> my site </title>
    <meta name="description" content="" />
    <meta name="keywords" content="" />
    <link rel="stylesheet" type="text/css" href="styles/main.css" />
    <!--[if lt IE 7]>
    <link rel="stylesheet" type="text/css" href="styles/ie6.css" media="screen" />
    <![endif]-->
    <!--[if gte IE 7]>
    <link rel="stylesheet" type="text/css" href="styles/ie7.css" media="screen" />
    <![endif]-->
</head>
<body id="contact">
<div id="wrap">
<? include("inc/header/header.php")?>

<div id="cwrap">
  <div id="content">

		<center><p><?php echo $success, $error; ?></p></center>
		<div class="contGen">

			<FORM ACTION="contact.php" METHOD="POST" name="contactform1">
			<div id="contformfirst">First Name:&nbsp; </div>
			<div id="contformfirstfld"><INPUT NAME="name" SIZE="30" class="FormField" value="<?php echo $dbfname; ?>"></div>

			<div id="contformemail">E-mail:&nbsp; </div>
			<div id="contformemailfld"><INPUT NAME="email" SIZE="30" class="FormField" value="<?php echo $dbemail; ?>"></div>

			<div id="contformcomments"><br><br>Comments:&nbsp; </div>
			<div id="contformcommentsfld"><textarea NAME="comments" rows="6" cols="23" SIZE="250"></textarea></div>

			<div id="contformsubmit"></div>
			<div id="contformreset"><input type='submit' name='submit' value='Submit'>
			<input type='reset' value='Reset'></div>
			</FORM>

		</div>
	</div>
    <? include("inc/left/leftnav.php")?>
</div>
<? include("inc/content/footer.php")?>
</div>
</body>
</html>
</body>
</html>

    It would seem to imply that $SESSION['customer'] is an object, not a string. So perhaps it's something like:

    $username = $_SESSION['customer']->username;

    But that's just a guess. Try doing a print_r() of $_SESSION['customer'] to see what it is and what the actual object variable names are (if I'm right).

    PS: You should be escaping any and all external inputs before using them in a database query. See [man]mysql_real_escape_string/man for the MySQL solution.

      Yes. that worked perfectly. Thanks

        Write a Reply...