PHP script to fetch data from mysql to android

Question

i have this script and i want to edit it so that it sends extra information to my android application from user table after checking if user already exists userStatues and userPosition

PS : i tried to edit it myself but i don't have proper knowledge in php to make it work or have time to learn php for the moment.. so kindly help if u can :)

<?php
$hostname_localhost ="";
$database_localhost ="";
$username_localhost ="";
$password_localhost ="";
$localhost = mysql_connect($hostname_localhost,$username_localhost,$password_localhost)
or
trigger_error(mysql_error(),E_USER_ERROR);

mysql_select_db($database_localhost, $localhost);

$username = $_POST['username'];
$password = $_POST['password'];
$query_search = "select * from user where username = '".$username."' AND password = '".$password. "'";
$query_exec = mysql_query($query_search) or die(mysql_error());
$rows = mysql_num_rows($query_exec);
//echo $rows;
 if($rows == 0) { 
 echo "No Such User Found"; 
 }
 else  {
    echo "User Found"; 
}
?>

So you want to echo the userStatuses and userPosition fields, right? — user5166265
– user5166265, Commented Aug 1, 2015 at 11:55
Also, in what manner do you expect the android application to get the data, is it just from the webpage's text after loading. Finally, are the db fields also called userStatuses and userPosition? — user5166265
– user5166265, Commented Aug 1, 2015 at 11:57
yes and i want to fetch those fields to my android application after the user successfully login — Mohamed Nageh
– Mohamed Nageh, Commented Aug 1, 2015 at 12:05
So something like this: In the first line of the page output, you have userStatuses, in the second one, userPosition. Right? — user5166265
– user5166265, Commented Aug 1, 2015 at 12:08
u can show me how to return one field and i will do the rest i already have PHP script that fetches the data from db to android but i want to edit the above script so that it do both " login process " and " fetching relevant data " — Mohamed Nageh
– Mohamed Nageh, Commented Aug 1, 2015 at 12:10

user5166265 · Accepted Answer · 2015-08-01 12:26:29Z

1

The solution you have right now is very vulnerable to SQL Injection. Here's a nice link telling you what that is: http://www.w3schools.com/sql/sql_injection.asp

To fix this, you should use something like PDO. Since you stated you don't have time to research these things, even though I would strongly recommend doing so to avoid any vulnerabilities like this one, I will replace your entire code with the non-vulnerable version:

<?php
$hostname_localhost ="";
$database_localhost ="";
$username_localhost ="";
$password_localhost ="";
$localhost = new PDO("mysql:host=$hostname_localhost;dbname=database_localhost", $username_localhost, $password_localhost);

$username = $_POST['username'];
$password = $_POST['password'];

$query = "select * from user where username = :username AND password = :password";
$query->bindValue(':username', $username);
$query->bindValue(':password', $password);
$query->execute;

$results = $query->fetchAll();

if(count($results) == 0)
    echo "No Such User Found";
else {
    echo "User Found";
    $data = array("userStatuses" => $results[0]["userStatuses"]
              "userPosition" => $results[0]["userPosition"]);

    echo json_encode($data)

    // OR

    echo $results[0]["userStatuses"].'<br/>'.$results[0]["userPosition"];
}
?>

answered Aug 1, 2015 at 12:26

user5166265

Sign up to request clarification or add additional context in comments.

2 Comments

Mohamed Nageh Over a year ago

i fixed ur answer a little and it now works just fine i will post the the fixed answer , thanks dude :)

user5166265 Over a year ago

@MohNage7 Thanks for fixing it bro :D

Ayo Makanjuola · Accepted Answer · 2015-08-01 12:32:38Z

0

After this portion of your code

$query_search = "select * from user where username = '".$username."' AND password = '".$password. "'";

$query_exec = mysql_query($query_search) or die(mysql_error());
$rows = mysql_num_rows($query_exec);
//echo $rows;
if($rows == 0) { 
   echo "No Such User Found"; 
 }
 else  {
    echo "User Found"; 
 }

Do the following

$otherDetails = array();
while ( $row = mysql_fetch_assoc($query_exec) ) {
    $otherDetails['userStatues'];
    $otherDetails['userPosition'];
}
//$otherDetails contains what you want
//you can send it down as json
echo json_encode( $otherDetails );

PLEASE NOTE: The line below present in your code:

$query_search = "select * from user where username = '".$username."' AND password = '".$password. "'";

Is source of security issues. E.g SQL injection and also shows that you are not encrypting your passwords in the database.

Use Php PDO to solve the SQL injection problem and use some hashing algorithms to solve the plain text password problem.

Cheers

edited Aug 1, 2015 at 12:32

answered Aug 1, 2015 at 12:19

Ayo Makanjuola

6487 silver badges14 bronze badges

4 Comments

user5166265 Over a year ago

This is vulnerable to SQL injection, why not use PDO?

Ayo Makanjuola Over a year ago

Oh there's more! The fact that he is selecting the user with a password without any hashing what so ever suggests that the password is saved in plain text! Which is a security risk also. I just used the code he was already working with so i don't cause more confusion.

user5166265 Over a year ago

Yeah, @MohNage7 I would recommend reading more into these things, you will cause a lot of security issues otherwise

Mohamed Nageh Over a year ago

@Makville it returns an empty array , but hey thanks ;)

Mohamed Nageh · Accepted Answer · 2015-08-01 15:00:56Z

after fixing @Lightwind answer's , here's the answer

<?php
$hostname_localhost ="";
$database_localhost ="";
$username_localhost ="";
$password_localhost ="";
$options_localhost  = array (PDO::ATTR_ERRMODE=>  PDO::ERRMODE_EXCEPTION);

$localhost = new PDO("mysql:host=$hostname_localhost;dbname=$database_localhost;charset=utf8", $username_localhost, $password_localhost,$options_localhost);

$username = filter_var($_POST['username'], FILTER_SANITIZE_STRING , NULL) ;;
$password = filter_var($_POST['password'], FILTER_SANITIZE_STRING , NULL) ;

$query  =  "select * from user where username = :username AND password = :password";
$sql     =$localhost->prepare ($query);
$sql->bindparam(':username', $username,PDO::PARAM_STR);
$sql->bindparam(':password', $password,PDO::PARAM_STR);
$sql->execute();

$results = $sql->fetchObject();

if (count($results) == 0) {
    echo "No Such User Found";
} else {
    echo "User Found";
    $data = array("status" => $results->userStatus);
    echo json_encode($data);
}
?>

Collectives™ on Stack Overflow

PHP script to fetch data from mysql to android

3 Answers 3

2 Comments

4 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related