mysql_num_rows（）：提供的参数在15中不是有效的MySQL结果资源

Question

Every time I try to run my script I get this error, saying that mysql_num_rows(): supplied argument is not a valid MySQL result resource. I'm not quite sure why its doing this. My goal is to get it to check to see if the client who logs in is an admin.

<?php
    session_start();
    $username = $_POST['username'];
    $password = $_POST['password'];

    if ($username&&$password)
    {

    $user = $_SESSION['user'];
    //connect
    $connect = mysql_connect("localhost","*******_robert","***********") or die ("Couldn't Connect"); //host,username,password
    mysql_select_db("virtua15_gateway") or die ("Could not find database");
    //query
    $get = mysql_query("SELECT * FROM Users WHERE username='$user'");
    $numrows = mysql_num_rows($query);
    if ($numrows!=0)
    {
        while ($row = mysql_fetch_assoc($query))
        {
                $dbusername = $row['username'];
                $dbpassword = $row['password'];
        }
        if ($username==$dbusername&&$password==$dbpassword)
        {
         header( 'Location: index2.php' );
         $_SESSION['username']=$dbusername;
        }
        else
            echo "incorrect username and password";
    }
       else
         die ("This user does not exist");

    }
    else
        die("Please enter a username and a password");


    while($get = mysql_fetch_assoc($get))

{
 $admin = $row['admin'];
}
if ($admin==0)
 die ("You are not and admin!");
header('Location: index2.php')

?>

Answer 1

$get = mysql_query("SELECT * FROM Users WHERE username='$user'");
$numrows = mysql_num_rows($query);

So, is it $get or $query ?

Answer 2

You call your query resource $get, but then pass it as $query. Choose one :)

$query = mysql_query("SELECT * FROM Users WHERE username='$user'");
$numrows = mysql_num_rows($query);

Also, add an error checking in case the query fails (die() or trigger_error())

Might be also worth noting you need to escape any input instead of feeding it directly in your query (even from $_SESSION or $_COOKIES, not only $_POST). Use mysql_real_escape_string() for that. And you should not store password in clear text, might use sha1() or better hashing algos.

Answer 3

use this:

$get = mysql_query("SELECT * FROM Users WHERE username='$user'");
$numrows = mysql_num_rows($get);

instead of :

$get = mysql_query("SELECT * FROM Users WHERE username='$user'");
$numrows = mysql_num_rows($query);

Answer 4

$get = mysql_query("SELECT * FROM Users WHERE username='$user'");
$numrows = mysql_num_rows($get);

change $query to $get