I'm updating the existing php5 page to the php 7 version. The code in php 5 page has been working well. I'm trying to make it work before upgrading php5 to php7 in the admin.

------------ partly excerpted ----------
mysqli_select_db($link, $database);
$query = "SELECT * FROM database";
$Result = mysqli_query($byte, $query) or die(mysql_error());
$row = mysql_fetch_assoc($Result);
$totalRows = mysql_num_rows($Result);

---------------------- partly excerpted in the Result page --------------
<?php if ($totalRows > 0 ) { // Show detail ?>

[ html code ..... etc. etc. ]

<?php do { ?>
<li>
<a href="/index.php?id=<?php echo $row['ID']; ?>" <?php if ($_GET["id"] == $row['ID']) { ?>class="active"<?php } ?>><?php echo $row['Title']; ?></a>
</li>
<?php } while ($row = mysql_fetch_assoc($Result)); ?>

[ html code etc.. ]

<?php } // end ?>
------------ Result -----------

Warning: mysql_fetch_assoc() expects parameter 1 to be resource, object given in /di/...../ on line ..

Warning: mysql_num_rows() expects parameter 1 to be resource, object given in /..../....

I've made changes such as from mysql to mysqli, etc. but now it's where I'm stuck at. Your help will be greatly appreciated. Thank you.

    You'll need to replace all of your mysql_* calls with the appropriate mysqli_* calls, not just one or two. And note the difference in what you pass them. Code smells I won't comment on.

      Because magic_quotes has also been removed from php, there's no longer any protection against sql special characters in external string data breaking the sql query syntax, which is how sql injection is accomplished (your example query isn't putting any external data into the query, but you likely have queries that do based on your previous posts.)

      The simplest solution, that eliminates php code and sql syntax, rather than has you spending your time converting it, that's also secure, is to skip the mysqli extension altogether, and use the PDO extension. Also, use prepared queries when supplying external/unknown data to an sql query statement (while this adds a single php statement per query, it also simplifies the sql query syntax), use implicate binding with a prepared query (supply an array of input values to the ->execute([...]) method call), and use exceptions for error handling (this adds one statement, when you make the database connection, and eliminates the or die(...) statements.) When you make the connection using PDO, set the error mode to exceptions, set emulated prepared queries to false, and set the default fetch mode to assoc.

      You should also separate the database specific code, that knows how to query for and fetch data, from the presentation code, that knows how to produce the output from the data. To do this, put the database specific code above the start of the html document, fetch all the data from a query into an appropriately named php variable, then test/loop over this variable at the appropriate point in the html document. If in the future, you switch to use an api to get data, you won't have to touch the presentation code in your html document, just fetch the data and put it into the php variable that the html document is expecting as its input.

      While this sounds like a lot of work, it results in the simplest, secure, overall solution.

        Write a Reply...