Click here to Skip to main content
15,886,137 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
Hi everyone! I have a problem in my code php and I dont why but happened

Quote:
This is the problem:
Warning: mysqli_num_row expects parameter 1 to be mysqli_result, bool given on line 27

I Have something againts the SQL injetion in js


This is my code:

<?php

session_start();
if(isset($_SESSION['nombredelusuario']))
{
	header('location: home.php');
}

if(isset($_POST['ingre']))
{
	
	$dbhost="localhost";
	$dbuser="root";
	$dbpass="";
	$dbname="clini";
	
	$conn=mysqli_connect($dbhost,$dbuser,$dbpass,$dbname);
	if(!$conn)
	{
		die("No hay conexión: ".mysqli_connect_error());
	}
	
	$nombre=$_POST['name'];
	$pass=$_POST['pass'];
	
	$query=mysqli_query($conn,"Select * from clini where name = '".$nombre."' and pass = '".$pass."'");
	$nr=mysqli_num_rows($query); HERE IS THE PROBLEM
	
	if(!isset($_SESSION['nombredelusuario']))
	{
	if($nr == 1)
	{
		$_SESSION['nombredelusuario']=$nombre;
		header("location: home.php");
	}
	else if ($nr == 0)
	{
		echo "<script>alert('Usuario no existe');window.location= 'login.php' </script>";
	}
	}
}
?>


What I have tried:

I tried very thing, but nothing and I dont why happened, very thanks ;)
Posted
Updated 24-Nov-21 16:09pm
Comments
Richard Deeming 25-Nov-21 3:59am    
Quite apart from the SQL Injection vulnerability in your code - which, as Peter pointed out, is NOT prevented by Javascript - you are storing your users' passwords in plain text.

I hope you have extremely deep pockets, because you're going to have to pay a massive fine once your database is breached!

Fix your code to use properly parameterized queries, and fix your password storage.

PHP: SQL Injection - Manual[^]
PHP: Prepared statements and stored procedures - Manual[^]

Secure Password Authentication Explained Simply[^]
Salted Password Hashing - Doing it Right[^]

PHP: password_hash[^]
PHP: password_verify[^]
XEmmanuel21 25-Nov-21 10:25am    
Thanks, but I have some functions in Javascript so that they do not introduce strange data, or does it not work?

1 solution

$query is FALSE (a boolean) because the previous line failed, and you didn't check the return from mysqli_query

Also, your Javascript is not the place to defend against SQL injection. Anyone who can use the browser dev tools can easily bypass it.
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900