MySqli_Fetch_Array Error

[wildbuddha]

Not quite sure what I'm doing wrong:

function getName()
{
	$db_hostname = "localhost"; 
	$db_username = "root";
	$db_password = "";
	$db_name =     "justinalba_module3_db";
	$dbc = @mysqli_connect($db_hostname, $db_username, $db_password, $db_name)
   	or die("Unable to connect to MySQL");
	$username = $_POST['userName'];
	$id=$_POST['id'];
	$sql="SELECT name_first, name_last FROM user WHERE name_username='$username' AND id='$id'";
	/*$query=mysqli_query($dbc,$sql) or die('no query');*/
	$result = $dbc->query($sql);
	while($row = $result->fetch_array()
	or die('names are not working')){
	echo $row['name_first'];
	echo " ";
	echo $row['name_last'];
	}
}

I'm getting the die error "names are not working."  Thanks, in advance for any help.

[DaveyK]

Well, I would say that the $_POST you are trying to access is not defined inside that function. Your function doesnt use any variables. That is not wrong by itself, but its not the correct way to do it. In this case, that function is ONLY useful when used with a form.  Instead, make the function have a single variable, ID. You pass that variable and use it inside the function whenever you call it.

 

Some other notes:

1) Why are you suppressing the mysqli_connect but adding an or die()? Does "or die()" even work if you suppress the function in the first place?

2) You dont have to do a while on a fetch_array() if you know the returned rows are either 0 or 1 (assuming the ID you are passing is unique.)

3) SQL Injection. Your current query is vulnerable. You could use mysqli::bind_param() or mysqli::real_escape_string()

4) Functions become more useful and functional if you return the data rather than echoing it. You can then process the data on the page you are calling the function, rather than losing that functionality at all or having to add it to the function.

[DavidAM]

1) Suppressing errors is NOT a good idea. Let them get reported in DEVELOPMENT and fix them. Then log them in production. However, the "@" error suppression suppress only PHP errors. If the PHP code is good and the connection is attempted, it will return a value OR it will return FALSE if unable to connect. This is where the OR DIE() comes in.

 

2) The WHILE loop is your problem. I've never seen OR DIE() used in that way.

while($row = $result->fetch_array() will load a row of data into the $row variable and process the statements inside the loop. Then it will try to fetch another row. When there are no more rows to fetch, this method returns FALSE, so you know it is done. With the OR DIE on there, it will ALWAYS be executed after processing the last row in the resultset.

 

If you only expect one row, you don't need a loop. If you expect multiple rows, you don't want the OR DIE().