Stuck with connectivity PHP and MySQL - php

Question

I am working on PHP and MySQL environment for first time..
And I got another problem with my connectivity.
I am unable to create a connection between both of them.
I am trying to make a code for login page.
My database name and all those things are correct.
Here's my code..
<?php
$con = NULL;
if (empty($_POST['username']) || empty($_POST['password'])) {
$error="Username or Password is invalid";
}
else {
global $con;
$con=mysqli_connect("localhost","root","","student");
if (mysqli_connect_errno()) {
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
else {
$sql = "select * from login where password='" . $_POST['password'] . "' AND username='" . $_POST['username'] . "'";
echo $sql;
$query=mysqli_query($sql,$con);
$rows=mysqli_num_rows($query);
echo $rows;
if ($rows==1) {
$_SESSION['login_user'] = $_POST['username'];
//Initializing Session
header("location: /pages/profile.php"); //Redirecting to other page
} else {
$error = "Username or Password is invalid";
}
}
//SQL query to fetch information of registered users and finds user match.
//Closing Connection
mysql_close($con);
}
?>
Errors :
Warning: mysqli_query() expects parameter 1 to be mysqli, string given in C:\xampp\htdocs\pages\login.php on line 21
Warning: mysqli_num_rows() expects parameter 1 to be mysqli_result, null given in C:\xampp\htdocs\pages\login.php on line 24
Warning: mysql_close() expects parameter 1 to be resource, object given in C:\xampp\htdocs\pages\login.php on line 39

Answer 1

The first warning tells you exactly what's wrong:
Warning: mysqli_query() expects parameter 1 to be mysqli, string given in C:\xampp\htdocs\pages\login.php on line 21
Here you define your variables:
$con=mysqli_connect("localhost","root","","student");
// ...
$sql = "select * from login where password='" . $_POST['password'] . "' AND username='" . $_POST['username'] . "'";
So $con is a mysqli object and $sql is a string. Then you call the function:
$query=mysqli_query($sql,$con);
You're passing it the string and then the connection. The error says that the first object should be the connection. Like this:
$query=mysqli_query($con,$sql);
Also, and this is important... I realize you're just getting started and just learning the concepts. But make sure you understand this before writing any code which would be used in any live system or which would be responsible for any user's data. Your code is wide open to SQL injection attacks. Basically, any user has complete access to your database and probably you server. Please start by reading this.
What this code currently does, even though you may not be aware of it, is it executes user input as code. Clearly you don't want any user to be able to execute any arbitrary code they want on your server, but currently that's exactly what you're allowing. Again, you're new, so it's an understandable mistake. I'm not trying to blame you, just convince you of the importance of this. Especially when your websites start to contain user data.