SQL works in php admin but returns empty result in

Question

Here is my code:

  $usersql = "Select fab2_type from feesys_admin where adminname ='$_POST[username]' and adminemail = '$_POST[password]'";
        $userresult = mysql_query($usersql) or die ("<h3>Error in query: $query. ".mysql_error()."</h3>");
        $num_rows = mysql_num_rows($userresult);
        if($num_rows > 0) {
            if($userresult['fab2_type']=='Partner'){
        }

When I run the SQL statement on the database through PHP Admin, it works fine. But it returns empty within the results here.

I checked to make sure the database connects fine. I checked all spelling Number of rows returns correctly. No syntax errors. When I echo the username and password and the sql statement, it's all correct.

This code used to work so I have no idea what's going wrong here.

Answer 1

It is because you have not quoted your $_POST array variables properly. You have $_POST[username] and $_POST[password]. It should be $_POST['username'] and $_POST['password']. This causes PHP to interpret username and password as constants.

Here is a different shot at your syntax -

$usersql = "SELECT `fab2_type` FROM `feesys_admin` WHERE `adminname` ='".$_POST['username']."' AND `adminemail` = '".$_POST['password']."' ";

You could further shorten this by predefining (as Fred says below).

$user = $_POST['username']; // please sanitize this
$pass = $_POST['password']; // please sanitize this
$usersql = "SELECT `fab2_type` FROM `feesys_admin` WHERE `adminname` ='".$user."' AND `adminemail` = '".$pass."' ";

You're very at risk for SQL injection if you don't clean up user input.

• Consult the following on Stack: How to prevent SQL Injection.

---

Password related

I noticed you may be storing passwords in plain text. If this is the case, it is highly discouraged.

I recommed you use CRYPT_BLOWFISH or PHP 5.5's password_hash() function.
For PHP < 5.5 use the password_hash() compatibility pack.

Plus, in regards to SQL injection, use mysqli with prepared statements, or PDO with prepared statements, they're much safer.