Mysql PHP错误 - 登录验证

Question

Good Day Gents

Busy really frustrating myself here. I am busy trying to write a simple login script that validates a login against the database.

However i keep on getting:

Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in

here is my code.... when i run the query on sql workbench it works 100%

<?php

// Grab User submitted information
$email = $_POST['users_email'];
$pass = $_POST['users_pass'];

// Connect to the database
$con = mysql_connect('localhost','root','');
// Make sure we connected succesfully
if(! $con)
{
    die('Connection Failed'.mysql_error());
}

// Select the database to use
mysql_select_db('arctecs',$con);

$result = mysql_query('SELECT users_email, users_pass FROM users WHERE users_email = $email');

$row = mysql_fetch_array($result);

if($row['users_email']==$email && $row['users_pass']==$pass)
    echo'You are a validated user.';
else
    echo'Sorry, your credentials are not valid, Please try again.';
?>

Answer 1

This is not correct

'SELECT users_email, users_pass FROM users WHERE users_email = $email'

better way is

"SELECT users_email, users_pass FROM users WHERE users_email = '$email'"

Need to wrap the string data in single quote.

The POST data is directly being used in the query which is not good. Start using PDO prepared statements to avoid sql injections or at-least sanitize data as

$email = $_POST['users_email'];
$pass = $_POST['users_pass'];
$con = mysql_connect('localhost','root','');
// Make sure we connected succesfully
if(! $con)
{
    die('Connection Failed'.mysql_error());
}

$email = mysql_real_escape_string($email);