PHP page output/echo always null, no generated error logs - php

Question

I'm trying to create an extremely basic script that can function as a REST API. I've been having a lot of trouble getting any output to show on the page. In the code below you can see a couple of the commented methods I've tried to get an output. If I remove the printf while loop and just use the responseData = json_encode($result) line, I get a JSON output in the proper format but only containing null values. (Table columns have the appropriately named table headers but nothing else, no data is returned). For the record, the SQL statements, are being properly executed without error. The below script generates no PHP.log errors when run. If I change the SQL to an insert statement I can see the resulting values in the database. So whatever is going on here is some issue with simply outputting those values to the page.
This is the code for the entire page script I am using;
<?php
define("PROJECT_ROOT_PATH", __DIR__);
define("DB_HOST", "localhost");
define("DB_USERNAME", "testuser");
define("DB_PASSWORD", "testpw");
define("DB_DATABASE", "testgb");
$uri = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
$uri = explode( '/', $uri );
/** Basic Input Filter **/
function input_filter($data) {
$data= trim($data);
$data= stripslashes($data);
$data= htmlspecialchars($data);
return $data;
}
/**
* Get URI elements.
*
* #return array
*/
function getUriSegments()
{
$uri = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
$uri = explode( '/', $uri );
return $uri;
}
function sendOutput($data, $httpHeaders=array())
{
header_remove('Set-Cookie');
if (is_array($httpHeaders) && count($httpHeaders)) {
foreach ($httpHeaders as $httpHeader) {
header($httpHeader);
}
}
echo $data;
exit;
}
/**
* "/[usertoken]/read" Endpoint - retrieve orders from db
*/
function readAction()
{
$strErrorDesc = '';
$requestMethod = $_SERVER["REQUEST_METHOD"];
$arrQueryStringParams = parse_str($_SERVER['QUERY_STRING'], $query);
if (strtoupper($requestMethod) == 'GET') {
try {
$intLimit = 100;
if (isset($arrQueryStringParams['limit']) && $arrQueryStringParams['limit']) {
$intLimit = $arrQueryStringParams['limit'];
}
$intItemId = 0;
if (isset($arrQueryStringParams['itemid']) && $arrQueryStringParams['itemid']) {
$intItemId = $arrQueryStringParams['itemid'];
echo $intItemId;
}
$conn = mysqli_connect(DB_HOST, DB_USERNAME, DB_PASSWORD, DB_DATABASE);
if ($conn->connect_error)
{
die("Connection failed: ". mysqli_connect_error());
}
$sql = "SELECT * FROM verified_orders WHERE itemid=?;";
$stmt = mysqli_stmt_init($conn);
if (!mysqli_stmt_prepare($stmt, $sql)) {
die("Statement preparation failed.");
} else {
mysqli_stmt_bind_param($stmt, "d", $intItemId);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
if ($row = mysqli_fetch_assoc($result)) {
while ($row = $result -> fetch_row()) {
printf ("%s (%s)\n", $row[0], $row[1]);
}
}
/*$responseData = json_encode($result);*/
}
} catch (Error $e) {
$strErrorDesc = $e->getMessage().'.';
$strErrorHeader = 'HTTP/1.1 500 Internal Server Error';
}
} else {
$strErrorDesc = 'Method not supported';
$strErrorHeader = 'HTTP/1.1 422 Unprocessable Entity';
}
// send output
if (!$strErrorDesc) {
/*echo $responseData;
} else {
echo $responseData;*/
}
}
if (isset($uri[2]) && $uri[2] != 'user') {
header("HTTP/1.1 404 Not Found");
exit();
}
if ($uri[3] == "read") {
readAction();
}
?>

Answer 1

Database API changes and misleading parse_str()
updated: There were a few errors going on in the end, combined with a lack of logs, resulting in a messy thread; I've updated this answer postmortem, to consolidate the solutions and realizations.
There seemed to be some problems with the database access (mixed forms of mysqli-fetching) and potentially false expectations, due to associative vs numeric results ($row[0], $row[1] were attempted in assoc mode). In the end, the entire set of Mysqli connect/prepare/query/fetch-calls were replaced with known good PDO variants; namely:
if (!($conn = new PDO(sprintf('mysql:dbname=%s;host=%s', DB_DATABASE, DB_HOST), DB_USERNAME, DB_PASSWORD, [ PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION ])))
throw new Exception('Connection failed');
if (!($stmt = $conn->prepare('
SELECT *
FROM verified_orders
WHERE itemid = :itemid
ORDER BY itemid
'))) throw new Exception('Prepare failed');
if (!$stmt->execute([ 'itemid' => $intItemId ]))
throw new Exception('Execute failed');
if (!($data = $stmt->fetchAll( PDO::FETCH_ASSOC|PDO::FETCH_GROUP|PDO::FETCH_UNIQUE )))
throw new Exception('Fetch failed');
Which is not to say that the mysqli-variants itself couldn't have been fixed. The problem just wasn't readily apparent.
The PDO database calls solved most problems, but not the absence of any value in the $intItemId variable (which is used in the SELECT query). That variable lived downstream from $arrQueryStringParams, which in turn was ment to be set here:
$arrQueryStringParams = parse_str($_SERVER['QUERY_STRING'], $query);
At first glance this looked fine, however the parse_str() function produces no return value. It actually injects the results into the 2nd argument, which in this case was a stray variable called $query (which wasn't used anywhere else at all).
The proper syntax for parse_str() would be:
parse_str($_SERVER['QUERY_STRING'], $arrQueryStringParams);
Original attempts at a solution
You're using mysqli_fetch_assoc to fetch the query results (note the associative).
This means the results won't end up in $row[0], $row[1], ... But instead $row is an associative array based on the column names, such as $row['itemid'].
offtopic note: you should remove the ; at the end of your SQL query. It can be a part of a SQL script command , where it denotes the end of a statement, but it isn't considered part of a single query.
update
Try replacing
$result = mysqli_stmt_get_result($stmt);
if ($row = mysqli_fetch_assoc($result)) {
while ($row = $result -> fetch_row()) {
printf ("%s (%s)\n", $row[0], $row[1]);
}
}
with
while ($row = $result->fetch_array(MYSQLI_BOTH)) {
printf ("%s (%s)\n", $row[0], $row[1]);
}
See if that fixes the problem.
if it does not then check the logfiles and show the output of var_dump($x) for $row, $result, $stmt and $conn.
And then repeat that process again after replacing the SQL with:
$sql = "SELECT 123 AS num, 'abc' AS str, ? AS inputval";
update 2
Weird results, without anything to go on debugging wise, its probably best to try the following. (Temporarily) remove all your code starting at the line:
/** Basic Input Filter **/
and from there, all the way to the end of the file. Basically only leaving your defines; and then copy/paste the following at the bottom of the file, and then try to visit the page in your webbrowser, see what it prints.
try {
echo 'A';
if (!($conn = new PDO(sprintf('mysql:dbname=%s;host=%s', DB_DATABASE, DB_HOST), DB_USERNAME, DB_PASSWORD, [ PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION ])))
throw new Exception('Connection failed');
echo 'B';
if (!($stmt = $conn->prepare('
SELECT *
FROM verified_orders
WHERE itemid = :itemid
OR 1=1
ORDER BY itemid
LIMIT 20
'))) throw new Exception('Prepare failed');
echo 'C';
if (!$stmt->execute([ 'itemid' => 1 ]))
throw new Exception('Execute failed');
echo 'D';
if (!($data = $stmt->fetchAll( PDO::FETCH_ASSOC|PDO::FETCH_GROUP|PDO::FETCH_UNIQUE )))
throw new Exception('Fetch failed');
echo 'E';
echo PHP_EOL . '<br>';
var_dump( $data );
echo PHP_EOL . '<br>';
echo 'F';
} catch (Throwable $e) { echo PHP_EOL . '<br>Exception: ' . htmlentities($e->getMessage()); }
Exit(0);