MySQL query acting weird

Question

I've got:

mysql_connect($host,$username,$password);
@mysql_select_db("db") or die("Error: Cannot select database");
$query = "select password from users where name = '".$_POST['login-userid']."'";
$result = mysql_query($query);

if ($result == false) {
    echo "Invalid username or password";
} else {
    if (mysql_result($result,0) == hash('sha256', $_POST['login-password'])) {
         echo "Logging in...";
    }
}

For some reason I keep getting an error for the mysql_result line, even when it shouldn't be executed (when the username doesn't exist, ie $result evaluates to false).

Answer 1

mysql_query will only return false if there is an error. In this case there is no error, there are just 0 rows.

You need to use mysql_num_rows to get the number of rows returned.

Answer 2

You can var_dump($result) and see the value, if it's a resource (according to php ), then your query was successful, if not false is returned. It's a boolean false but your == should still be respected if indeed false was returned.

Answer 3

mysql_query($query);

returns the result set of your query. It does not return true or false.

You may use mysql_num_rows() to check if the result of the query exist such as:

if(mysql_num_rows($query)) {
   // exist
} else {
   // does not exist
}