警告：mysql_fetch_array（）预计参数1是资源，布尔在C中给出：\ XAMPP \ htdocs中\ login.php中

Question

，我发现了以下错误

警告：mysql_fetch_array（）预计参数1是资源，在C：\ xampp \ htdocs \ login.php中给出的布尔值

其他所有工作都正常......除此之外！

这里是我的查询：

<?php 

$inputuser = $_POST["user"]; 
$inputpass = $_POST["pass"]; 

$user = "root"; 
$password = ""; 
$database = "share"; 

$connect = mysql_connect("localhost:3306",$user,$password); 
@mysql_select_db($database) or ("Database not found"); 

$query = "SELECT * FROM 'users' WHERE 'username'= '$inputuser'"; 
$querypass = "SELECT * FROM 'users' WHERE 'password'= '$inputpass'"; 

$result = mysql_query($query); 
$resultpass = mysql_query($querypass); 

$row = mysql_fetch_array($result); 
$rowpass = mysql_fetch_array($resultpass); 

$serveruser = $row['user']; 
$serverpass = $row['password']; 

if ($serveruser && $serverpass) { 
    if (!$result) { 
     die ("Invalid Username/Password"); 

} 
     header('Location: Fail.php'); 
     mysql_close(); 


if ($inputpass == $serverpass) { 

     header('Location: Home.php'); 

} else { 


} 
} 

?> 

Answer 1

Do not use mysql_* functions. They are deprecated.

您的SQL语法错误。更改您的查询，以这样的：

必须使用反引号，`而不是'报价。

并请尽量给他们这样的组合：

SELECT * FROM `users` WHERE `username`= '$inputuser' AND `password`= '$inputpass'; 

如果有两个用户使用相同的密码？你不能指望所有的用户使用不同的密码吗？

其他东西。您正在将用户输入直接传递给SQL。这是很差并导致SQL注入。所以，你需要消毒的投入，然后才能将其发送到数据库服务器：

$inputuser = mysql_real_escape_string($_POST["user"]); 
$inputpass = mysql_real_escape_string($_POST["pass"]); 

Again, do not use mysql_* functions.

更新代码

使用下面的代码。

// single query 
$query = "SELECT * FROM `users` WHERE `username`='$inputuser' AND `password`='$inputpass'"; 
// your original query 
$query = "SELECT * FROM `users` WHERE `username`= '$inputuser'"; 

终极密码

<?php 
    $inputuser = mysql_real_escape_string($_POST["user"]); 
    $inputpass = mysql_real_escape_string($_POST["password"]); 

    $user = "root"; 
    $password = ""; 
    $database = "share"; 

    $connect = mysql_connect("localhost", $user, $password); 
    @mysql_select_db($database) or ("Database not found"); 

    $query = "SELECT * FROM `users` WHERE `username`= '$inputuser' AND `password`= '$inputpass'"; 

    $result = mysql_query($query); 

    if (mysql_num_rows($result) == 1) { 
     header('Location: Home.php'); 
     die(); 
    } 
    else { 
     header('Location: Fail.php'); 
     die ("Invalid Username/Password"); 
    } 
?>