-5

可能重复：
警告：mysql_fetch_array()：提供的参数不是有效的 MySQL 结果

我有一个 PHP 脚本，用户可以在其中更改他的帐户设置。但是有一个问题，因为我有一个我找不到的错误。你能帮我吗。

警告：mysql_fetch_assoc() 期望参数 1 是资源，布尔值在第 69 行的 /Applications/XAMPP/xamppfiles/htdocs/tutorials/findFriends/account_settings.php 中给出

<?
include ("inc/incfiles/header.inc.php");
if ($user) {

}
else
{
 die ("You must be logged in to view this page!");
}
?>
<?
$senddata = $_POST['senddata'];

//Password variables
$old_password = strip_tags($_POST['oldpassword']);
$new_password = strip_tags($_POST['newpassword']);
$repeat_password = strip_tags($_POST['newpassword2']);

if ($senddata) {
//If the form has been submitted ...

$password_query = mysql_query("SELECT * FROM users WHERE username='$user'");
while ($row = mysql_fetch_assoc($password_query)) {
    $db_password = $row['password'];

    //md5 the old password before we check if it matches
    $old_password_md5 = md5($old_password);

    //Check whether old password equals $db_password
    if ($old_password_md5 == $db_password) {
     //Continue Changing the users password ...
     //Check whether the 2 new passwords match
     if ($new_password == $repeat_password) {
        if (strlen($new_password) <= 4) {
         echo "Sorry! But your password must be more than 4 character long!";
        }
        else
        {

        //md5 the new password before we add it to the database
        $new_password_md5 = md5($new_password);
       //Great! Update the users passwords!
       $password_update_query = mysql_query("UPDATE users SET password='$new_password_md5' WHERE username='$user'");
       echo "Success! Your password has been updated!";

        }
     }
     else
     {
      echo "Your two new passwords don't match!";
     }
    }
    else
    {
     echo "The old password is incorrect!";
    }
}
 }
else
{
 echo "";
}


$updateinfo = $_POST['updateinfo'];

//First Name, Last Name and About the user query
$get_info = mysql_query("SELECT first_name, last_name, bio FROM users WHERE username='$user'");
$get_row = mysql_fetch_assoc($get_info);
$db_firstname = $get_row['first_name'];
$db_last_name = $get_row['last_name'];
$db_bio = $get_row['bio'];

//Submit what the user types into the database
if ($updateinfo) {
 $firstname = strip_tags($_POST['fname']);
 $lastname = strip_tags($_POST['lname']);
 $bio = $_POST['bio'];


 if (strlen($firstname) < 3) {
echo "Your first name must be 3 more more characters long.";
 }
 else
 if (strlen($lastname) < 5) {
echo "Your last name must be 5 more more characters long.";
}
else
{
//Submit the form to the database
$info_submit_query = mysql_query("UPDATE users SET first_name='$firstname', last_name='$lastname', bio='$bio' WHERE username='$user'");
echo "Your profile info has been updated!";
header("Location: $user");
}
}
else
{
 //Do nothing
}
?>
<h2>Edit your Account Settings below</h2>
<hr />
<form action="account_settings.php" method="post">
<p>CHANGE YOUR PASSWORD:</p> <br />
Your Old Password: <input type="text" name="oldpassword" id="oldpassword" size="40"><br />
Your New Password: <input type="text" name="newpassword" id="newpassword" size="40"><br />
Repeat Password  : <input type="text" name="newpassword2" id="newpassword2" size="40"><br />
<input type="submit" name="senddata" id="senddata" value="Update Information">
</form>
<hr />
<form action="account_settings.php" method="post">
<p>UPDATE YOUR PROFILE INFO:</p> <br />
First Name: <input type="text" name="fname" id="fname" size="40" value="<? echo $db_firstname; ?>"><br />
Last Name: <input type="text" name="lname" id="lname" size="40" value="<? echo $db_last_name; ?>"><br />
About You: <textarea name="bio" id="bio" rows="7" cols="40"><? echo $db_bio; ?></textarea>

<hr />
<input type="submit" name="updateinfo" id="updateinfo" value="Update Information">
</form>
<br />
<br />

如果我想更改名字或姓氏，则会出现以下错误：

警告：无法修改标头信息 - 标头已由 /Applications/XAMPP/xamppfiles/htdocs/ 中的（输出开始于 /Applications/XAMPP/xamppfiles/htdocs/tutorials/findFriends/inc/incfiles/header.inc.php:72）发送第 93 行的教程/findFriends/account_settings.php

这是 header.inc.php：

<?
include ("inc/scripts/mysql_connect.inc.php");
session_start();
if (isset($_SESSION['user_login'])) {
$user = $_SESSION["user_login"];
}
else {
$user = "";
}
?>
<!DOCTYPE html>

<html lang="en">
<head>
        <meta charset="utf-8">

        <link rel="stylesheet" href="css/reset.css" media="screen">
        <link rel="stylesheet" href="css/master.css" media="screen">
        <link rel="stylesheet" href="css/blue.css" media="screen">
    <link rel="stylesheet" href="css/main.css" media="screen">
    <script src="http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.min.js"></script>
        <script src="js/jquery.color.js"></script>
        <script src="js/script.js"></script>
    <script src="js/placeholder-js.js" type="text/javascript"></script>
    <script src="js/main.js" type="text/javascript"></script>

        <title>findFriends</title>
</head>
<body>
                <div class="mashmenu">
                        <div id="menuWrapper">
                        <div class="fnav">

                                <a href="#" class="flink" >findFriends+ </a>

                                <div class="allContent">

                                        <div class="snav" >
                                                <a href="#" class="slink" >About findFriends</a>

                                                <div class="insideContent">

                                                        <span class="featured" >What is it?<br />
                            findFriends is an open source social network, created for the sinimma YouTube tutorial
                            series. All code is explained and completely free to download and use.<a href="http://www.youtube.com/sinimma">Visit our YouTube
                            channel ...</a>
                            </span>
                                                </div><!-- end insideContent -->
                                        </div><!-- end snav -->

                                        <div class="snav" >
                                                <a href="#" class="slink" >Open Source?</a>
                                                <div class="insideContent">
                                                        <span class="featured" >All code is open source and freely availible,</span>
                                                        because this means that anyone can download and improve the source code whatever
                            way they want without permission. <br />You may use this source code in any way to do anything.
                            All we <br />ask is that you keep the link at the bottom of the page, as a way of saying thanks for
                            all of the work we have done. :)
                                                </div><!-- end insideContent -->
                                        </div><!-- end snav -->

                                        <div class="snav" >
                                                <a href="http://www.youtube.com/sinimma" class="slink" >Youtube Channel</a>
                                                <div class="insideContent">
                                                        <span class="featured" ></span>
                                        </div><!-- end snav -->
                    </div>
                                </div><!-- end allContent -->

                        </div><!-- end fnav -->

                        <?
                        if (isset($_SESSION["user_login"])) {
                        echo '

                        <div class="fnav">

                                <a href="' . $user . '" class="flink" >' . $user . '\'s Profile</a>

                        </div><!-- end fnav -->
                        <div class="fnav">

                                <a href="account_settings.php" class="flink" >Account Settings</a>

                        </div><!-- end fnav -->
                        <div class="fnav">

                                <a href="logout.php" class="flink" >Logout</a>

                        </div><!-- end fnav -->

                        ';
                        }
                        else
                        {
                                echo '

                                <div class="fnav">

                                <a href="index.php" class="flink" >Sign Up+ </a>

                        </div><!-- end fnav -->
            <div class="fnav">

                                <a href="index.php" class="flink" >Login+ </a>

                        </div><!-- end fnav -->

                                ';
                        }
                        ?>

                        <div class="feat">
                                <form id="searchForm">
                <fieldset>
                    <div class="input">
                        <input type="text" class="Search" id="s" value="Search findFriends ..." />
                    </div>
                    <input type="submit" id="searchSubmit" value="" />
                </fieldset>
            </form>
                        </div><!-- end fnav feat -->
          </div>
                </div><!--end mashmenu -->
        <div id="wrapper">
<br />
<br />
<br />
<br />
4

2 回答 2

2

您查询失败。这是99.99%的情况，只要您看到“期望参数 1 是资源，给定布尔值”错误消息。它弹出是因为您尝试在进一步的调用中使用查询结果，但如果失败，您获得的不是您期望的资源，而是布尔值 ( false)。

经验法则是：始终检查查询是否成功，使用类似的代码

$result = mysql_query()
if( $result !== false ) {
   // ok, let's proceed
}

此外，您的代码很容易受到SQL 注入攻击。始终通过诸如mysql_real_escape_string().

编辑

由于您的代码中只有一个查询，请替换：

$password_query = mysql_query("SELECT * FROM users WHERE username='$user'");

和

$password_query = mysql_query( sprintf("SELECT * FROM users WHERE username='%s'",
                       mysql_real_escape_string($user)) );

这将解决您的问题。你应该放弃strip_tags()。在这里使用它不是正确的地方，因为您正在破坏用户输入。最后不是$password_query，而是$password_query_result。

PS：考虑放弃mysql_扩展并使用mysqli_or PDO。mysql_扩展名已弃用。它不应该是任何痛苦的过渡，因为mysqli_主要是直接替换。

于 2012-11-25T20:52:27.710 回答
0

问题在于这个查询（第 68 行）：

$get_info = mysql_query("SELECT first_name, last_name, bio FROM users WHERE username='$user'");

此查询失败因此$get_info包含布尔值FALSE而不是需要的 MySQL 资源mysql_fetch_assoc。

并检查您的脚本是否存在 SQL 注入漏洞 - 您的脚本非常容易受到攻击！

于 2012-11-25T20:55:17.847 回答