mysql_num_rows（）：提供的参数不是有效的MySQL结果资源（唯一）

Question

Basically I am pulling values fro four variables from a form and then using those values as WHERE statements in selecting from a table in my DB. I am only providing a snippet of my code here, because I have verified that the correct values are coming from the form to the variables in question, and the code works great and moves past the if statement into my else statement when I am only checking groupid and memberid.

groupid is a 4 digit number. memberid is a 3 digit number. name is a full name like John A. Smith and dob is a date like 1900-10-31

The query I am trying to run is below. After I get the MySQL error it does display the message "Member does not exist." What am I missing here?

$qry="SELECT * FROM members WHERE groupid = $groupid AND memberid = $memberid AND   membername = $name AND memberdob = $dob";
$result=mysql_query($qry);

if(mysql_num_rows($result) == 0)
    {
    echo "Member does not exist";
    }
 else  {....

Answer 1

$qry="SELECT * FROM members 
      WHERE groupid = $groupid 
      AND memberid = $memberid
      AND membername = '$name'
      AND memberdob = '$dob'";

Put quotes around membername and memberdob

Answer 2

groupid is a 4 digit number. memberid is a 3 digit number. name is a full name like John A. Smith and dob is a date like 1900-10-31

That's what you think. Golden rule: never trust any input from user .

If you want to stick to the mysql extension, then first of all sanitize the input with mysql_real_escape_string . And secondly, quote the variables you pass to the query. So, instead of

$qry = "... WHERE groupid = $groupid ...";

do

$qry = "... WHERE groupid = '" . mysql_real_escape_string($groupid) . "'...";

In your case, the most probable reason for the query to fail is the $name variable. It contains spaces. The space is where the query breaks. Quoting the variable will solve the issue:

$qry = "SELECT *
        FROM members
        WHERE groupid = '" . mysql_real_escape_string($groupid) . "'
        AND memberid = '" . mysql_real_escape_string($memberid) . "'
        AND membername = '" . mysql_real_escape_string($name) . "'
        AND memberdob = '" . mysql_real_escape_string($dob) . "'";

Also, improve the query execution with error handling. Simple example:

$result = mysql_query($qry) or die('Invalid query: ' . mysql_error());

This will return detailed error description which will help you to determine the root cause.

As for the recommended alternatives for the discouraged mysql extension: please read about Choosing an API in the PHP manual.

Answer 3

Being unaware of the whole context of your application, I will assume that the variables are handled properly after being retrieved from the form.

mysql normally complains about string fields if they are not properly enclosed in quotes. It could be that $name and $memberdob are retrieved from the form correctly but are not passed into the query as needed. Try changing your query to the following:

$qry="SELECT * FROM members WHERE 
      groupid = $groupid AND memberid = $memberid AND
      membername = '$name' AND memberdob = '$dob'";