Check if user exists in database error - php

Question

I'm really new to php and been following a tutorial on youtube by php academy. Basically it's a script(s) that allows for login,registering and a remember me option, the tutorial is 2 years old so I tried to change some of the mysql functions to mysqli but I'm running into some problems..when I enter a username and hit login I get a "mysql_num_rows() expects parameter 1 to be resource, string given in user.php line 9" error and my if statement says "cannot find username try registering" but it should show "exists" because the username I entered is in fact in the database..I'm puzzled, also please forgive me if the script isn't the most secure, I know things should be escaped and such, your help would be appreciated
User.php :
<?php
function user_exists($username)
{
$username=$username;
$query = ("SELECT count(`user_id`) FROM `users` WHERE `username`='$username'");
if(mysql_num_rows($query)===1)
{return true;
} else{
return false;
}
}
?>
login.php
<?php
include ('core/init.php');
if(user_exists('drellen')===true){
echo "exists";
}
if(empty($_POST)===false){
$username=$_POST['username'];
$password=$_POST['password'];
if(empty($username) === true|| empty($password)=== true)
{
echo $error[]="Enter a username and password";
}
else if (user_exists($username)===false)
{
echo $error[]="Cannot find username try registering";
}
}
please note that the init.php has users.php included in it*****
Might have a mixture of the old mysql and the new mysqli functions mixed in, help making it full mysqli would be appreciated

Answer 1

You have not used mysql_query() to run query. How you get number of rows without it.
Note -> You should use mysqli_* functions instead of mysql_*
$query = mysqli_query("SELECT count(`user_id`) FROM `users` WHERE `username`='$username'");
//$row = mysqli_fetch_array($query);
$count = mysqli_num_rows($query);

Answer 2

you can try this
function user_exists($username)
{
$result = mysql_query("SELECT `user_id` FROM `users` WHERE `username`='$username' LIMIT 1 ") or die(mysql_error());
if($row = mysql_fetch_assoc($result))
{
return true;
}
else
{
return false;
}
}
Note : mysql_* is deprecated. use mysqli_* or PDO
UPDATE 2:
function user_exists($username)
{
global $your_db_conn;
$sql = "SELECT `user_id` FROM `users` WHERE `username`='$username' LIMIT 1 ";
$result = mysql_query($sql, $your_db_conn) or die(mysql_error());
if($row = mysql_fetch_assoc($result))
{
return true;
}
else
{
return false;
}
}

Answer 3

Here is a working example
After doing some digging around i found that the most important part in this new function is calling the global $db, and for sanitizing adding the $db, $data as well as in the query. if you look up other basic exampels of using mysqli_query($db, $sql); you will catch onto this quite easily
<?php
$db = mysqli_connect('localhost', 'root', 'password', 'database');
function sanitize($data) {
global $db;
return mysqli_real_escape_string($db, $data);
}
function user_exists($username)
{
global $db;
$username = sanitize($username);
$sql = "SELECT `id` FROM `Users` WHERE `username`='$username' LIMIT 1";
$result = mysqli_query($db, $sql) or die('query');
if($row = mysqli_fetch_assoc($result))
{
return true;
}
else
{
return false;
}
}
?>
<h1>test</h1>
<?php
if (user_exists('admin') === true){
echo "Good news, this exists";
} else {
echo "no good";
}
?>