Looping through query results with fetch(PDO::FETCH_ASSOC) - php

Question

I have moved away from mysqli_query() due to server requirements on a new project. However, I am having issues with updating some of my queries.
Connection file
<?php
define('DB_HOST', 'localhost');
define('DB_NAME', 'nj2kfa3j_sublift');
define('DB_USER', 'nj2kfa3j_web');
define('DB_PASS', 'prum9wR4');
define('DB_CHAR', 'utf8');
class DB
{
protected static $instance = null;
protected function __construct() {}
protected function __clone() {}
public static function instance()
{
if (self::$instance === null)
{
$opt = array(
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
PDO::ATTR_EMULATE_PREPARES => FALSE,
);
$dsn = 'mysql:host='.DB_HOST.';dbname='.DB_NAME.';charset='.DB_CHAR;
self::$instance = new PDO($dsn, DB_USER, DB_PASS, $opt);
}
return self::$instance;
}
public static function __callStatic($method, $args)
{
return call_user_func_array(array(self::instance(), $method), $args);
}
public static function run($sql, $args = [])
{
if (!$args)
{
return self::instance()->query($sql);
}
$stmt = self::instance()->prepare($sql);
$stmt->execute($args);
return $stmt;
}
}
?>
Problem Query Statement:
$stmt = DB::run("SELECT * FROM admin WHERE username='$manager' AND password='$password' LIMIT 1");
$existCount = $stmt->fetchColumn();
if ($existCount == 1){
$id;
$full_name;
var_dump($stmt);
while ($row = $stmt->fetch(PDO::FETCH_ASSOC)){
$id = $row["id"];
$full_name = $row["full_name"];
echo 'test';
}
}
I have done other queries in more or less the same way and they're working, like this:
$stmt = DB::run("SELECT * FROM categories");
while ($row = $stmt->fetch(PDO::FETCH_ASSOC)){
What is going on here? In the query above the var_dump() is returning:
object(PDOStatement)#2 (1) { ["queryString"]=> string(81) "SELECT * FROM admin WHERE username='********' AND password='********' LIMIT 1" }
But it is not entering the while loop and hitting the echo 'test';

Answer 1

Please use prepared statements. Your function is designed to accept prepared statements. Also, don't store your password as plain text; use password_hash() and password_verify().
You can fetch your results as an array with fetchall() and then count the array elements.
<?php
$params = [$manager,$password];
$sql = "SELECT * FROM admin WHERE username= ? AND password= ? LIMIT 1";
$stmt = DB::run($sql,$params);
$results = $stmt->fetchall(PDO::FETCH_ASSOC); // Returns an array
if (count($results) > 0){
$id;
$full_name;
foreach($results as $key=>$row){
$id = $row["id"];
$full_name = $row["full_name"];
echo 'test';
}
}
?>

Answer 2

As discussed in the comments, I was looking for an alternative to mysqli_num_rows() and found rowCount().
The following now works for me:
$stmt = DB::run("SELECT * FROM admin WHERE username='$manager' AND password='$password' LIMIT 1");
$existCount = $stmt->rowCount();
if ($existCount == 1){