-1

I have crated one log in form in which i want that user can change the password for that i have created as below

if(isset($_SESSION['user_name']))
{
    $password=$_POST['new_password'];
    $query="select * from login where  username = '$_SESSION[user_name]' and password='" . md5($_SESSION['password']) . "'  ";
    echo $query;
    $result=mysql_query($query);
    //echo "abc";
    if(mysql_num_rows($result))
    {   
        $row=mysql_fetch_array($result);
        $pass=$row['password'];
        if($pass==$password)
        {
            $query2="UPDATE login SET password='$password' WHERE username='$_SESSION[user_name]'";
            echo $query2;
            echo "Password changed successfully";
        }
        else
        {
            echo "You entered wrong current password";
        }
    }

}

but the Warning mysql_num_rows() expects parameter 1 to be resource. is coming on the line "if(mysql_num_rows($result))". what is the solution for that?

Pradeep
  • 59
  • 1
  • 1
  • 6

4 Answers4

0

change this:

 $query="select * from login where  username = '$_SESSION[user_name]' and password='" . md5($_SESSION['password']) . "'  ";

To:

$query="select * from login where  username = '".$_SESSION['user_name']."' and password='" . md5($_SESSION['password']) . "'  ";
Joke_Sense10
  • 5,101
  • 2
  • 16
  • 22
0

Your query ($query) is failing and therefore not producing a query resource, its because of the quotes '".$_SESSION[user_name]."'

user2092317
  • 3,136
  • 5
  • 22
  • 35
0

$result in your case may contain resource and false as well.
You see this message when you got false, means your query has failed.
Simple solution is to add check for it

if ($result){
  if(mysql_num_rows($result))
  ...
} else {
  // FIXME: Handle this exception
  echo("Query has failed");
}

Also, you should know that mysql_query is deprecated. Consider switching to MySQLi or PDO_MySQL

More reading

Nagh
  • 1,727
  • 1
  • 14
  • 19
0

Use :

$result = mysql_query($query) or die(mysql_error());

Also mysql_* functions are depreciated. You should be used pdo or mysqli.

See Why shouldn't I use mysql_* functions in PHP? for more details.

Community
  • 1
  • 1
Roy M J
  • 6,856
  • 7
  • 47
  • 77