Mysqli_num_rows问题

Question

First the code

mysqli_free_result($wynik);

$query = mysqli_query($dbcon, "SELECT * FROM user WHERE login = '$login' AND password ='$pass'");

$sql = mysqli_num_rows($query) 
        or die(drop dead);

echo $sql;

if ($sql > 0) {

                $_SESSION['user'] = $login;
                $_SESSION['auth'] = TRUE;
                echo $login;

I have a small issue with this code. When $query finds a result everything works fine, but when it returns no results $sql part dies. I can't understand why. When i run the query in database it works fine and returns 0 results.

Answer 1

Because when you get no rows, you basically get 0 or die(). 0 is "falsy", so your die is executed. You don't want a die() there, basically just remove it.

$sql = mysqli_num_rows($query); // Don't use die() for this

See this live demo.

---

It's more common to use or die() after the query, although it's not the best handling of errors, this is probably where you've seen it before

$query = mysqli_query($dbcon, "SELECT * FROM user WHERE login = '$login' AND password ='$pass'") or die ("Query failed ".mysqli_error($dbcon));

---

Also you should look into prepared statements to protect your database against SQL injection. See the links given below.

• http://php.net/mysqli.prepare
• How can I prevent SQL injection in PHP?