return null in function thst execute query

Question

My problem is my function return null value and doesn't execute my query

function getUsers($username,$fields = '*')
{
    $db_host = "localhost";
    $db_user = "root";
    $db_pass = "";
    $db_name = 'filemanagerusers';
    $connection = new mysqli($db_host,$db_user,$db_pass,$db_name);
    ////////////////////////////////////////////////////////////////
    $query = "select $fields from users where username=".$username;
    $result = $connection->query($query);
    $customers = mysqli_fetch_assoc($result);//etelaate user dar ghalebe yek array be ma barmigarde
    return $customers;
}

Are you sure that your `username` is an integer? if not enclose within quotes — Thamilhan, Aug 08 '17 at 13:12
Add `ini_set('display_errors', 1); ini_set('log_errors',1); error_reporting(E_ALL); mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);` to the top of your script. This will force any `mysqli_` errors to generate an Exception that you can see on the browser and other errors will also be visible on your browser. — RiggsFolly, Aug 08 '17 at 13:14
Learn to check for errors, like `$result = $connection->query($query); if ($result === FALSE) var_dump($connection->error);` etc. See documentation for every function You use and read it completely to see, what results it can give if error occurs. — Roman Hocke, Aug 08 '17 at 13:15
You may want to be aware of [what is one SQL injection](https://stackoverflow.com/questions/601300/what-is-sql-injection). — , Aug 08 '17 at 13:16
Your script is at risk of [SQL Injection Attack](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Even [if you are escaping inputs, its not safe!](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) Use [prepared parameterized statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) — RiggsFolly, Aug 08 '17 at 13:19

Serving Quarantine period · Answer 1 · 2017-08-09T05:10:03.273

A quick unsafe fix for you (but not preferable due to SQL Injection):-

$query = "select $fields from users where username= '$username'";

Note:- enclose $username with quotes to make it string.

The preferred way:-

Always use prepared statements of mysqli_* to prevent from SQL Injection like below:-

function getUsers($username,$fields = '*')
{
    $db_host = "localhost";
    $db_user = "root";
    $db_pass = "";
    $db_name = 'filemanagerusers';
    $connection = mysqli_connect(($db_host,$db_user,$db_pass,$db_name);
    /* check connection */
    if (mysqli_connect_errno()) {
        printf("Connect failed: %s\n", mysqli_connect_error());
        exit();
    }
    if ($stmt = mysqli_prepare($connection, "SELECT $fields FROM users where username=?")) {

        /* bind parameters for markers */
        mysqli_stmt_bind_param($stmt, "s", $username);

        /* execute query */
        mysqli_stmt_execute($stmt);

        /* bind result variables */
        mysqli_stmt_bind_result($stmt, $customers);


        /* close statement */
        mysqli_stmt_close($stmt);

        /* return result*/

        return $customers;
    }
}

The second snipped should be the only provided solution. Also, it must be made sure that `$fields` is not user-controlled. — , Aug 08 '17 at 13:29

return null in function thst execute query

1 Answers1