为什么num_rows不返回任何值？

Question

I have the following PHP code where I want to return the number of rows based on the previous SQL statement, however, $num doesn't doesn't seem to be returning anything.

$ipAddress = $_SERVER['REMOTE_ADDR'];

if ($result = $mysqli->query("SELECT * FROM whovisit WHERE ipAddress = ".$ipAddress."")) {
    $num = $result->num_rows;
}
echo $num; // <-- not showing up on my page

if ($num > 0) {
    $sqlupdate = $mysqli->query("UPDATE whovisit SET visitCount = visitCount + 1 WHERE ipAddress = ".$ipaddress."");
}
else {
    $sqlupdate = $mysqli->query("INSERT INTO whovisit values ('".$_SERVER['REMOTE_ADDR']."', '1')");
}

Any ideas? Thanks

Answer 1

Ensure that you have a $ infront of ipaddress

$ipaddress = $_SERVER['REMOTE_ADDR'];

As the IP address is a string it should be put in single quotes.

if ($result = $mysqli->query("SELECT * FROM whovisit WHERE ipAddress = '".$ipAddress."';")) {
    $num = $result->num_rows;
}

If you are unsure if the query is running correctly you could also add an else to the above if statment and output any mysql error messages.

}else{
    echo "QueryError: ".$mysqli->error
}

Answer 2

If you get nothing on the page, this means $num must not be being set. Given the code you have, that would mean the if block is not being executed - ie $result is a falsey value. Which means your query is failing.

And unfortunately this one's pretty easy if you examine the generated query. Following what happens step-by-step, we see you're injecting the contents of the server variable REMOTE_ADDR , which is presumably going to be an IPv4 address in a dotted-decimal format, into the query string. So you'll have a SQL statement like, which fails to parse at the second . :

SELECT * FROM whovisit WHERE ipAddress = 127.0.0.94

Oops.

---

Since the IP address is a string, you need to enclose it in single quotes:

"SELECT * FROM whovisit WHERE ipAddress = '".$ipAddress."'"

Which will result in the queries in the following form:

SELECT * FROM whovisit WHERE ipAddress = '127.0.0.94'

Or better yet, use a parameterized query and you don't have to worry about quoting and escaping. $_SERVER['REMOTE_ADDR'] is probably relatively safe as far as SQL injection attacks go, but 1)it's easier to use parameters than a concatenated string, and 2)you never truly can trust a value you didn't generate yourself.

Answer 3

Similar post:

php switching to mysqli: num_rows issue

In PHP v 5.2 mysqli::num_rows is not set before fetching data rows from the query result.