Web design PHP SQL Query issue - php

Question

This is one of my functions in my function.php file. Right now I'm just trying to get it to output 1 or 0 depending if the username is in the MYSQL DB.
function retrieve_single($col, $table, $item, $con) {
require_once('include/global.php');
$sql = "SELECT * FROM users WHERE username = Username1";
$conn = new mysqli($DBServer, $DBUser, $DBPass, $DBName);
if ($conn->connect_error) {
trigger_error('Database connection failed: '.$conn->connect_error, E_USER_ERROR );
}
$rs=$conn->query($sql);
if($rs === false) {
trigger_error('Wrong SQL: ' . $sql . ' Error: ' . $conn->error, E_USER_ERROR);
} else {
$rows_returned = $rs->num_rows;
echo $rows_returned;
}
}
I keep changing stuff around trying to figure out what's wrong with it, all I know it is a sql error I keep getting. As of right now I have it written without the variables because of trying to figure out the problem.
The global.php:
$DBServer = 'localhost'; $DBUser = 'root'; $DBPass = ''; $DBName = 'social';
Can anyone help me out! I know the problem is simple, as this is my first time having this problem

Answer 1

The error you say that you're getting and you haven't shown us, is caused by this:
WHERE username = Username1 ";
^ ^ // missing quotes
It needs to have single quotes placed around Username1
I.e.:
WHERE username = 'Username1'";
If you're not already doing so, add error reporting to the top of your file(s) which will help during production testing.
error_reporting(E_ALL);
ini_set('display_errors', 1);
mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);

Answer 2

Your function is very confusing. How are you calling it in the rest of your code?
function retrieve_single($col, $table, $item, $con) {
require_once('include/global.php');
$sql = "SELECT * FROM users WHERE username = Username1";
$conn = new mysqli($DBServer, $DBUser, $DBPass, $DBName);
if ($conn->connect_error) {
trigger_error('Database connection failed: '.$conn->connect_error, E_USER_ERROR );
}
$rs=$conn->query($sql);
if($rs === false) {
trigger_error('Wrong SQL: ' . $sql . ' Error: ' . $conn->error, E_USER_ERROR);
} else {
$rows_returned = $rs->num_rows;
echo $rows_returned;
}
}
So your interface to retrieve_single() has the following $col, $table, $item and $con. But where are they used in the function? They seem 100% not used at all. So you are just calling it like retrieve_single() and hope it works? Seems odd.
Then within your function your query is this:
$sql = "SELECT * FROM users WHERE username = Username1";
Which makes little sense. It should at least have single quotes around it like this:
$sql = "SELECT * FROM users WHERE username = 'Username1'";
But it seems like it should be a variable like this:
$sql = "SELECT * FROM users WHERE username = '$Username1'";
But that said, where would $Username1 come from? Perhaps—looking at your interface variables—that should be $item like this:
$sql = "SELECT * FROM users WHERE username = '$item'";
Perhaps the whole function needs to be refactored to accommodate all the oddities I noticed like this:
function retrieve_single($col, $table, $item, $con) {
require_once('include/global.php');
$sql = "SELECT $col FROM $table WHERE username = '$item'";
if ($con->connect_error) {
trigger_error('Database connection failed: '.$con->connect_error, E_USER_ERROR );
}
$rs=$conn->query($sql);
if($rs === false) {
trigger_error('Wrong SQL: ' . $sql . ' Error: ' . $con->error, E_USER_ERROR);
} else {
$rows_returned = $rs->num_rows;
echo $rows_returned;
}
}
Using this refactored function you would access it like this outside of the function:
$con = new mysqli($DBServer, $DBUser, $DBPass, $DBName);
retrieve_single('*', 'users', 'Username1', $con);
Then again, no idea how you are actually using your function in your larger code so this is me just winging it based on what you have presented. As it stands, the function itself—as you have presented it—is just problematic.