September 13, 200719 yr Hi guys! Im getting this error... Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/public_html/site/test/html/editdev_insert.php on line 19 Just wondering what this means? Also if some selected fields are empty(some are optional), I want to flash up as errors but it still processes the form if the input box is empty? Thanks for your help! <?php //error_reporting(0); $page_title = 'Edit Dev'; $imagesize='height="500" width="170"'; $alignright='right'; $devname=$_POST['devname']; $devarea=$_POST['devarea']; $devsubdescript=$_POST['devsubdescript']; $linksite=$_POST['linksite']; $devdescript=nl2br($_POST['devdescript']); $id = $_GET['id']; require_once ('../../mysql_connect.php'); // Connect to the db. if($id){ $query = "SELECT * FROM developments WHERE user_id=$id"; $result = mysql_query ($query) or die("Query error: ". mysql_error()); // Run the query. $num = mysql_num_rows($result); $myrow = mysql_fetch_array($result, MYSQL_ASSOC); echo '<h3>edit development</h3> '; // display echo '<h3>' .$myrow['devname'] .'</h3>'; echo '<h3>' .$myrow['devarea'] .'</h3>'; echo '<h4><img ' . $imagesize .' src="uploads/'.$myrow['file1'.$file] .'" class="mainimage" /></h4>'; } //End if id // Retrieve the information. $query = "SELECT devname, devarea, devsubdescript, linksite, devdescript FROM developments WHERE user_id = $id"; $result = mysql_query ($query); // Run the query. if (mysql_num_rows($result) == 1) { // Valid user ID, show the form. $myrow = mysql_fetch_array ($result, MYSQL_NUM); $devdescript=(htmlspecialchars(strip_tags($myrow[4]))); // Create the form. echo '<br />'; echo '<br /> <form method="post" action="admin_editdev.php"> <p>Development Name: <input type="text" name="devname" size="70" maxlength="100" value="' . $myrow[0] . '" /></p> <p>Development Area: <input type="text" name="devarea" size="70" maxlength="100" value="' . $myrow[1] . '" /></p> <p>Development Subdescription: <input type="text" name="devsubdescript" size="70" maxlength="100" value="' . $myrow[2] . '" /></p> <p>Link to site: <input type="text" name="linksite" size="70" maxlength="100" value="' . $myrow[3] . '" /></p> <p>Development Description: <textarea rows="70" cols="68" name="devdescript">' . $devdescript . '</textarea></p><br /> <p><input type="submit" name="submit" value="Submit" /></p> <input type="hidden" name="submit" value="TRUE" /> <input type="hidden" name="edit_id" value="' . $id . '" /> </form>'; } // now echo the html page if($_POST['submit']){ /// check the form for entry problems if(empty($_POST['devname'])){ /// CHECK DEV NAME FORM HAVE BEEN FILLED IN $whatsediterror[1]='<p class="style1">Please complete development name.</p>'; $error='false'; } // end if if(empty($_POST['devarea'])){ /// CHECK DEV AREA FORM HAVE BEEN FILLED IN $whatsediterror[2]='<p class="style1">Please complete development area.</p>'; $error='false'; } // end if if(empty($_POST['devsubdescript'])){ /// CHECK DEV SUB FORM HAVE BEEN FILLED IN $whatsediterror[3]='<p class="style1">Please complete development sub area.</p>'; $error='false'; } // end if // not needed if(empty($_POST['linksite'])){ /// CHECK LINK FORM HAVE BEEN FILLED IN // not needed $whatsediterror[4]='<p class="style1">Please complete link to website.</p>'; // not needed $error='false'; // not needed } // end if if(empty($_POST['devdescript'])){ /// CHECK NEWS FORM HAVE BEEN FILLED IN $whatsediterror[4]='<p class="style1">Please complete development description.</p>'; $error='false'; } if (empty($errors)) { // If everything's OK. $id = $_POST['edit_id']; // Make the query. $query = "UPDATE developments SET devname='$devname', devarea='$devarea', devsubdescript='$devsubdescript', linksite='$linksite', devdescript='$devdescript' WHERE user_id=$id"; $result = mysql_query ($query); // Run the query. if (mysql_affected_rows() == 1) { // If it ran OK. // Print a message. echo '<br /><h3>edit development</h3><p>The development has been edited.</p>'; echo '<br /><p><a href="admin_mandev.php">Back</a></p>'; // Public message. } else { // If it did not run OK. echo '<br /><h3>edit news</h3><p>The Article has NOT been edited, please try again.</p>'; echo '<br /><p><a href="admin_mandev.php">Back</a></p>'; // Public message. exit(); } } else { // Report the errors. echo '<h3>error</h3> <p class="error">The following error(s) occurred:<br />'; foreach ($errors as $msg) { // Print each error. echo " - $msg<br />\n"; } echo '<p>Please try again.</p><br /></p>'; } // End of if (empty($errors)) IF. } // End of submit conditional. mysql_close(); // Close the database connection. ?>
September 13, 200719 yr this happens when: * there are 0 rows returned (depending on MySQL set up) * there is an error in your query string. At any rate, simply using COUNT(*) in your initial query will do the job just as well.
September 13, 200719 yr Ok, first of some very important stuff: Never Trust The User! Your code inserts $_GET['id'] without validating the string or escaping it. That's asking for trouble. It'd be very easy to insert malicious code there and nuke your entire database. Secondly: you assign a variable $error = 'false'; Then you check if it's empty. A better way of doing it is using the true boolean values. $error = false; // Init the variable at the beginning // ... some code goes here if (!$error) { // Everything ok, do the query } I'm not entirely sure why it says it's not a valid MySQL resource as it should short circuit on the 'or die()' statement. But you don't seem to be using that variable further down anyways? Also, instead of using if($_POST['submit']){ use if(isset($_POST['submit'])){ I'd recommend that you set error_reporting to E_ALL | E_STRICT for your development machine to catch all warnings and notices.
September 13, 200719 yr this happens when:* there are 0 rows returned (depending on MySQL set up) * there is an error in your query string. At any rate, simply using COUNT(*) in your initial query will do the job just as well. No, mysql_num_rows should report 0 then. And if there's an error in his query it'd return FALSE and his "or die()" statement will kick in.
September 13, 200719 yr I found this comment in the PHP manual: In PHP 5, mysql_affected_rows looks for the link as the first parameter, not a MySQL result.
September 13, 200719 yr Sorry, didn't notice it was was describing a different function name. Dunno what it did under mysql_num_rows...
September 13, 200719 yr Author Thanks, Ive made a few changes... <?php //error_reporting(0); error_reporting (E_ALL); $page_title = 'Edit Dev'; $imagesize='height="500" width="170"'; $alignright='right'; $devname=$_POST['devname']; $devarea=$_POST['devarea']; $devsubdescript=$_POST['devsubdescript']; $linksite=$_POST['linksite']; $devdescript=nl2br($_POST['devdescript']); require_once ('../../mysql_connect.php'); // Connect to the db. $id = $_GET['id']; if($id){ $query = "SELECT * FROM developments WHERE user_id=$id"; $result = mysql_query ($query) or die("Query error: ". mysql_error()); // Run the query. $myrow = mysql_fetch_array($result, MYSQL_ASSOC); echo '<h3>edit development</h3> '; // display echo '<h3>' .$myrow['devname'] .'</h3>'; echo '<h3>' .$myrow['devarea'] .'</h3>'; echo '<h4><img ' . $imagesize .' src="uploads/'.$myrow['file1'.$file] .'" class="mainimage" /></h4>'; } //End if id // Retrieve the information. $query = "SELECT devname, devarea, devsubdescript, linksite, devdescript FROM developments WHERE user_id = $id"; $result = mysql_query ($query); // Run the query. if (mysql_num_rows($result) == 1) { // Valid user ID, show the form. $myrow = mysql_fetch_array ($result, MYSQL_NUM); $devdescript=(htmlspecialchars(strip_tags($myrow[4]))); // Create the form. echo '<br />'; echo '<br /> <form method="post" action="admin_editdev.php"> <p>Development Name: <input type="text" name="devname" size="70" maxlength="100" value="' . $myrow[0] . '" /></p> <p>Development Area: <input type="text" name="devarea" size="70" maxlength="100" value="' . $myrow[1] . '" /></p> <p>Development Subdescription: <input type="text" name="devsubdescript" size="70" maxlength="100" value="' . $myrow[2] . '" /></p> <p>Link to site: <input type="text" name="linksite" size="70" maxlength="100" value="' . $myrow[3] . '" /></p> <p>Development Description: <textarea rows="70" cols="68" name="devdescript">' . $devdescript . '</textarea></p><br /> <p><input type="submit" name="submit" value="Submit" /></p> <input type="hidden" name="submit" value="TRUE" /> <input type="hidden" name="edit_id" value="' . $id . '" /> </form>'; } // now echo the html page if(isset($_POST['submit'])){ /// check the form for entry problems if(empty($_POST['devname'])){ /// CHECK DEV NAME FORM HAVE BEEN FILLED IN $whatsediterror[1]='<p class="style1">Please complete development name.</p>'; $error='false'; } // end if if(empty($_POST['devarea'])){ /// CHECK DEV AREA FORM HAVE BEEN FILLED IN $whatsediterror[2]='<p class="style1">Please complete development area.</p>'; $error='false'; } // end if if(empty($_POST['devsubdescript'])){ /// CHECK DEV SUB FORM HAVE BEEN FILLED IN $whatsediterror[3]='<p class="style1">Please complete development sub area.</p>'; $error='false'; } // end if // not needed if(empty($_POST['linksite'])){ /// CHECK LINK FORM HAVE BEEN FILLED IN // not needed $whatsediterror[4]='<p class="style1">Please complete link to website.</p>'; // not needed $error='false'; // not needed } // end if if(empty($_POST['devdescript'])){ /// CHECK NEWS FORM HAVE BEEN FILLED IN $whatsediterror[4]='<p class="style1">Please complete development description.</p>'; $error='false'; } if (!$error) { // If everything's OK. $id = $_POST['edit_id']; // Make the query. $query = "UPDATE developments SET devname='$devname', devarea='$devarea', devsubdescript='$devsubdescript', linksite='$linksite', devdescript='$devdescript' WHERE user_id=$id"; $result = mysql_query ($query); // Run the query. if (mysql_affected_rows() == 1) { // If it ran OK. // Print a message. echo '<br /><h3>edit development</h3><p>The development has been edited.</p>'; echo '<br /><p><a href="admin_mandev.php">Back</a></p>'; // Public message. } else { // If it did not run OK. echo '<br /><h3>edit news</h3><p>The Article has NOT been edited, please try again.</p>'; echo '<br /><p><a href="admin_mandev.php">Back</a></p>'; // Public message. exit(); } } else { // Report the errors. echo '<h3>error</h3> <p class="error">The following error(s) occurred:<br />'; foreach ($error as $msg) { // Print each error. echo " - $msg<br />\n"; } echo '<p>Please try again.</p><br /></p>'; } // End of if (empty($errors)) IF. } // End of submit conditional. mysql_close(); // Close the database connection. ?> Ive turned on all error reporting and now get: Notice: Undefined index: devname in /home/public_html/site/test/html/editdev_insert.php on line 6 Notice: Undefined index: devarea in /home/public_html/site/test/html/editdev_insert.php on line 6 Notice: Undefined index: devsubdescript in /home//public_html/site/test/html/editdev_insert.php on line 6 Notice: Undefined index: linksite in /home/public_html/site/test/html/editdev_insert.php on line 6 Notice: Undefined index: devdescript in /home/public_html/site/test/html/editdev_insert.php on line 6 When clicked... Notice: Undefined index: id in /home/public_html/site/test/html/editdev_insert.php on line 7 Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/public_html/site/test/html/editdev_insert.php on line 20 Warning: Invalid argument supplied for foreach() in /home/public_html/site/test/html/editdev_insert.php on line 75 Also Never Trust The User!Your code inserts $_GET['id'] without validating the string or escaping it. That's asking for trouble. It'd be very easy to insert malicious code there and nuke your entire database. How can I validate the string or excape it? Thanks for help!
September 13, 200719 yr Check if it's a number if you want to create some error report back to the user if it's an invalid argument. but allways use mysql_real_escape_string on anything you insert into the query. $id = mysql_real_escape_string($_GET['id']); The "Notice: Undefined index:" means that you are using a variable that hasn't been initialized yet. It hasn't been created. It's a good practice to make sure all your variables has been defined before use as it reduces risk of unforeseen bugs creeping up on you.
September 13, 200719 yr Author Thanks! Never new about mysql_real_escape_string! Im still getting this thou: Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/public_html/site/test/html/editdev_insert.php on line 19 and my error foreach isnt working, do I need to set $whatsediterror in the error array? Warning: Invalid argument supplied for foreach() in /home/public_html/site/test/html/editdev_insert.php on line 84 <?php //error_reporting(0); error_reporting (E_ALL); $page_title = 'Edit Dev'; $imagesize='height="500" width="170"'; $alignright='right'; require_once ('../../mysql_connect.php'); // Connect to the db. $id = mysql_real_escape_string($_GET['id']); if($id){ $query = "SELECT * FROM developments WHERE user_id=$id"; $result = mysql_query ($query) or die("Query error: ". mysql_error()); // Run the query. $myrow = mysql_fetch_array($result, MYSQL_ASSOC); echo '<h3>edit development</h3> '; // display echo '<h3>' .$myrow['devname'] .'</h3>'; echo '<h3>' .$myrow['devarea'] .'</h3>'; echo '<h4><img ' . $imagesize .' src="uploads/'.$myrow['file1'.$file] .'" class="mainimage" /></h4>'; } //End if id // Retrieve the information. $query = "SELECT devname, devarea, devsubdescript, linksite, devdescript FROM developments WHERE user_id = $id"; $result = mysql_query ($query); // Run the query. if (mysql_num_rows($result) == 1) { // Valid user ID, show the form. $myrow = mysql_fetch_array ($result, MYSQL_NUM); $devdescript=(htmlspecialchars(strip_tags($myrow[4]))); // Create the form. echo '<br />'; echo '<br /> <form method="post" action="admin_editdev.php"> <p>Development Name: <input type="text" name="devname" size="70" maxlength="100" value="' . $myrow[0] . '" /></p> <p>Development Area: <input type="text" name="devarea" size="70" maxlength="100" value="' . $myrow[1] . '" /></p> <p>Development Subdescription: <input type="text" name="devsubdescript" size="70" maxlength="100" value="' . $myrow[2] . '" /></p> <p>Link to site: <input type="text" name="linksite" size="70" maxlength="100" value="' . $myrow[3] . '" /></p> <p>Development Description: <textarea rows="70" cols="68" name="devdescript">' . $devdescript . '</textarea></p><br /> <p><input type="submit" name="submit" value="Submit" /></p> <input type="hidden" name="submit" value="TRUE" /> <input type="hidden" name="edit_id" value="' . $id . '" /> </form>'; } // now echo the html page if(isset($_POST['submit'])){ /// check the form for entry problems if(empty($_POST['devname'])){ /// CHECK DEV NAME FORM HAVE BEEN FILLED IN $whatsediterror[1]='<p class="style1">Please complete development name.</p>'; $error='false'; } // end if if(empty($_POST['devarea'])){ /// CHECK DEV AREA FORM HAVE BEEN FILLED IN $whatsediterror[2]='<p class="style1">Please complete development area.</p>'; $error='false'; } // end if if(empty($_POST['devsubdescript'])){ /// CHECK DEV SUB FORM HAVE BEEN FILLED IN $whatsediterror[3]='<p class="style1">Please complete development sub area.</p>'; $error='false'; } // end if // not needed if(empty($_POST['linksite'])){ /// CHECK LINK FORM HAVE BEEN FILLED IN // not needed $whatsediterror[4]='<p class="style1">Please complete link to website.</p>'; // not needed $error='false'; // not needed } // end if if(empty($_POST['devdescript'])){ /// CHECK NEWS FORM HAVE BEEN FILLED IN $whatsediterror[4]='<p class="style1">Please complete development description.</p>'; $error='false'; } if (!$error) { // If everything's OK. $id = $_POST['edit_id']; $devname=$_POST['devname']; $devarea=$_POST['devarea']; $devsubdescript=$_POST['devsubdescript']; $linksite=$_POST['linksite']; $devdescript=nl2br($_POST['devdescript']); // Make the query. $query = "UPDATE developments SET devname='$devname', devarea='$devarea', devsubdescript='$devsubdescript', linksite='$linksite', devdescript='$devdescript' WHERE user_id=$id"; $result = mysql_query ($query); // Run the query. if (mysql_affected_rows() == 1) { // If it ran OK. // Print a message. echo '<br /><h3>edit development</h3><p>The development has been edited.</p>'; echo '<br /><p><a href="admin_mandev.php">Back</a></p>'; // Public message. } else { // If it did not run OK. echo '<br /><h3>edit news</h3><p>The Article has NOT been edited, please try again.</p>'; echo '<br /><p><a href="admin_mandev.php">Back</a></p>'; // Public message. exit(); } } else { // Report the errors. echo '<h3>error</h3> <p class="error">The following error(s) occurred:<br />'; foreach ($error as $msg) { // Print each error. echo " - $msg<br />\n"; } echo '<p>Please try again.</p><br /></p>'; } // End of if (empty($errors)) IF. } // End of submit conditional. mysql_close(); // Close the database connection. ?>
September 13, 200719 yr For your queries; instead of: $query = "SELECT devname, devarea, devsubdescript, linksite, devdescript FROM developments WHERE user_id = $id"; try $query = "SELECT devname, devarea, devsubdescript, linksite, devdescript FROM developments WHERE user_id = '$id'"; Notice the single quotes around $id. See if that helps. And your foreach loop, you're trying to loop the wrong variable. foreach ($whatsediterror as $msg) { // Print each error. echo " - $msg<br />\n"; } This should work. However, it can also be done like this: echo implode("<br />\n - ", $whatsediterror) . "<br />\n";
September 13, 200719 yr Author Wicked thanks for that Thomas Thomassen! for some reason didnt think of escaping the id! doh Im still getting these errors: Notice: Undefined index: id in /home/public_html/site/test/html/editdev_insert.php on line 3 Notice: Undefined variable: error in /home/public_html/site/test/html/editdev_insert.php on line 53 But line 3 is: //error_reporting(0); and 53 is: </form>'; ???? <?php //error_reporting(0); error_reporting (E_ALL); $page_title = 'Edit Dev'; $imagesize='height="500" width="170"'; $alignright='right'; require_once ('../../mysql_connect.php'); // Connect to the db. $id = mysql_real_escape_string($_GET['id']); if($id){ $query = "SELECT * FROM developments WHERE user_id='$id'"; $result = mysql_query ($query) or die("Query error: ". mysql_error()); // Run the query. $myrow = mysql_fetch_array($result, MYSQL_ASSOC); echo '<h3>edit development</h3> '; // display echo '<h3>' .$myrow['devname'] .'</h3>'; echo '<h3>' .$myrow['devarea'] .'</h3>'; echo '<h4> <img ' . $imagesize .' src="uploads/'.$myrow['file1'] .'" class="mainimage" /></h4>'; } //End if id // Retrieve the information. $query = "SELECT devname, devarea, devsubdescript, linksite, devdescript FROM developments WHERE user_id = '$id'"; $result = mysql_query ($query); // Run the query. if (mysql_num_rows($result) == 1) { // Valid user ID, show the form. $myrow = mysql_fetch_array ($result, MYSQL_NUM); $devdescript=(htmlspecialchars(strip_tags($myrow[4]))); // Create the form. echo '<br />'; echo '<br /> <form method="post" action="admin_editdev.php"> <p>Development Name: <input type="text" name="devname" size="70" maxlength="100" value="' . $myrow[0] . '" /></p> <p>Development Area: <input type="text" name="devarea" size="70" maxlength="100" value="' . $myrow[1] . '" /></p> <p>Development Subdescription: <input type="text" name="devsubdescript" size="70" maxlength="100" value="' . $myrow[2] . '" /></p> <p>Link to site: <input type="text" name="linksite" size="70" maxlength="100" value="' . $myrow[3] . '" /></p> <p>Development Description: <textarea rows="70" cols="68" name="devdescript">' . $devdescript . '</textarea></p><br /> <p><input type="submit" name="submit" value="Submit" /></p> <input type="hidden" name="submit" value="TRUE" /> <input type="hidden" name="edit_id" value="' . $id . '" /> </form>'; } // now echo the html page if(isset($_POST['submit'])){ /// check the form for entry problems if(empty($_POST['devname'])){ /// CHECK DEV NAME FORM HAVE BEEN FILLED IN $whatsediterror[1]='<p class="style1">Please complete development name.</p>'; $error='false'; } // end if if(empty($_POST['devarea'])){ /// CHECK DEV AREA FORM HAVE BEEN FILLED IN $whatsediterror[2]='<p class="style1">Please complete development area.</p>'; $error='false'; } // end if if(empty($_POST['devsubdescript'])){ /// CHECK DEV SUB FORM HAVE BEEN FILLED IN $whatsediterror[3]='<p class="style1">Please complete development sub area.</p>'; $error='false'; } // end if // not needed if(empty($_POST['linksite'])){ /// CHECK LINK FORM HAVE BEEN FILLED IN // not needed $whatsediterror[4]='<p class="style1">Please complete link to website.</p>'; // not needed $error='false'; // not needed } // end if if(empty($_POST['devdescript'])){ /// CHECK NEWS FORM HAVE BEEN FILLED IN $whatsediterror[4]='<p class="style1">Please complete development description.</p>'; $error='false'; } if (!$error) { // If everything's OK. $id = $_POST['edit_id']; $devname=$_POST['devname']; $devarea=$_POST['devarea']; $devsubdescript=$_POST['devsubdescript']; $linksite=$_POST['linksite']; $devdescript=nl2br($_POST['devdescript']); // Make the query. $query = "UPDATE developments SET devname='$devname', devarea='$devarea', devsubdescript='$devsubdescript', linksite='$linksite', devdescript='$devdescript' WHERE user_id='$id'"; $result = mysql_query ($query); // Run the query. if (mysql_affected_rows() == 1) { // If it ran OK. // Print a message. echo '<br /><h3>edit development</h3><p>The development has been edited.</p>'; echo '<br /><p><a href="admin_mandev.php">Back</a></p>'; // Public message. } else { // If it did not run OK. echo '<br /><h3>edit news</h3><p>The Article has NOT been edited, please try again.</p>'; echo '<br /><p><a href="admin_mandev.php">Back</a></p>'; // Public message. exit(); } } else { // Report the errors. echo '<h3>error</h3> <p class="error">The following error(s) occurred:<br />'; foreach ($whatsediterror as $msg) { // Print each error. echo " - $msg<br />\n"; } echo '<p>Please try again.</p><br /></p>'; echo '<br /><p><a href="admin_mandev.php">Back</a></p>'; // Public message. } // End of if (empty($whatsediterror)) IF. } // End of submit conditional. mysql_close(); // Close the database connection. ?>
September 13, 200719 yr That is very strange... and the code you posted is the "/home/public_html/site/test/html/editdev_insert.php" file? (btw, remove the error reporting on the live server.)
September 14, 200719 yr Author (btw, remove the error reporting on the live server.) If I removed the error reporting its fine? how strange? Thanks again!
September 14, 200719 yr Removing the error reporting doesn't fix it. The problems are still there. The only difference is that the server doesn't report them. You want error reporting on for your development server to catch everything. But you don't want your live server to output anything that might be useful to someone with malicious intent.
September 15, 200719 yr Author Oh rite, still getting the errors mentioned above and that is the right code. odd!?
September 15, 200719 yr Very odd that the error refer to lines which doesn't contain anything described in the errors, yes. o_O hmmm
Create an account or sign in to comment