PHP - mysql_fetch_assoc() Error

Question

I try this for view single row data:

include("../engine/setconnect.php");

$sql = "SELECT id_member,username FROM account WHERE id_member=".$_GET['id_member'];

$result = mysql_query($sql);
$data  = mysql_fetch_assoc($result);

echo "$data['id_member']";
echo "$data['name']";

But the result always:

Warning: mysql_fetch_assoc() expects parameter 1 to be resource, boolean given in

Data in 'id_member' is alphanumeric

How to fix this? :(

Please, stop using the old deprecated `mysql` API and switch over to either `mysqli` or `PDO`. Both of which enables `Prepared statements`. Your code is very open for `SQL Injections` as of now. So either use prepared statements or escape the input from user (`$_GET` vars for example) before using them in a database query. — Jite, Nov 29 '14 at 07:26

score 4 · Accepted Answer · edited May 23 '17 at 11:48

If that field is indeed alpha numeric, then you should include quotes:

id_member = '".$_GET['id_member'] . "'";

Please, don't use mysql_* functions in new code. They are no longer maintained and are officially deprecated. See the red box? Learn about prepared statements instead, and use PDO or MySQLi - this article will help you decide which. If you choose PDO, here is a good tutorial.

_{Ref: https://stackoverflow.com/a/12860140/3859027}

Here is a simple example using PDO with prepared statements:

if(isset($_GET['id_member'])) {

    $db = new PDO('mysql:host=localhost;dbname=DATABASE_NAME', 'username', 'password');

    $sql = "SELECT id_member,username FROM account WHERE id_member = :id_member";

    $select = $db->prepare($sql);
    $select->bindParam(':id_member', $_GET['id_member']);
    $select->execute();

    $result = $select->fetch(PDO::FETCH_ASSOC);
    echo $result['username'];
}

@DavidRivaldy i urge you to port your codes to PDO, as you will be vulnerable to SQL injection. glad this helped — Kevin, Nov 29 '14 at 07:37

score 1 · Answer 2 · answered Nov 29 '14 at 07:27

1

Mysql is deprecated and I strongly suggest you to use prepared statements, but while this question is about mysql, I'll answer the question.

Data type of column id_member is not numeric. So you have to wrap it with quotes.

$sql = "SELECT id_member,username FROM account WHERE id_member='".$_GET['id_member']."'";

answered Nov 29 '14 at 07:27

Aycan Yaşıt

2,052
4
35
39

Thank dude, it's work! :) – Schreiner Nov 29 '14 at 07:30

PHP - mysql_fetch_assoc() Error

2 Answers2