MySQL to MySQli - help please

[kbc1]

Hi all

I have used mysql_pconnect for a long time. I now want to start using mysqli.

I have read through examples of the syntax to use but for the life of me I cannot get my first simple function to work. Its probably a stupid thing but if you can point it out I would be greatful as it will help me on my way.

I have my dbconn.php script as such:

	
$mysqli = new MySQLi(DBHOST, DBUSER, DBPASS, DBNAME);

if (mysqli_connect_errno()) {
	 echo mysqli_connect_error();
}	

I then have a index.php script of which includes dbconn.php and functions.php. On the index.php script I call showNewsPanel() function.

function showNewsPanel() {
	global $mysqli;

$qry 	= "SELECT * FROM tblnews WHERE publish = 1 ORDER BY id";
$qry  	= $mysqli->real_escape_string($qry);
$res 	= $mysqli->query($qry);
$cnt    = $res->num_rows;

if($cnt > 0) {
	while($row = $mysqli->fetch_array($res)){
		echo $row['name'];
	}
	$res->close();
}
}

I cannot get the function to output anything - where is it going wrong?

Thanks for reading.

[Derokorian]

First:

$qry      = $mysqli->real_escape_string($qry); 

You shouldn't be escaping the ENTIRE query string, this will definitely cause problems.

Second:

$res     = $mysqli->query($qry); 
    $cnt    = $res->num_rows; 

You need to check if the query was successful before attempting to use the results. Something like:

$res     = $mysqli->query($qry); 
if( $res === FALSE ) {
   trigger_error('DB Error. MySQL said: ('.$mysqli->errno.') '.$mysqli->error,E_USER_ERROR);
} else {
    $cnt    = $res->num_rows; 

Thirdly:

$res->close();

Result object does not have a close method.

Finally: Turn error reporting and display errors to on, I use the following at the top of my scripts while developing (make sure to turn off display errors for production!)

<?php
ini_set('error_reporting', -1);
ini_set('display_errors', True);

[Weedpacket]

Derokorian wrote:

You shouldn't be escaping the ENTIRE query string, this will definitely cause problems.

Well, not in this precise instance, because nothing in that query will be escaped (partly because there's nothing there that needs escaping).