[Skiller89]

Hi!
I try to get work this script:

PHP Code:

<?php

session_start();

require "database.php";



$title=$_POST['message_title'];

$to=$_POST['message_to'];

$content=$_POST['message_content'];

$from=$_POST['message_from'];

$time=$_POST['message_date'];



$ck_reciever = "SELECT username FROM user WHERE username = '".$to."'";



        

        if( mysql_num_rows( mysql_query( $ck_reciever ) ) == 0 ){

die("The user you are trying to contact don't excist. Please go back and try again.<br>

<form name=\"back\" action=\"new_message.php\"

method=\"post\">

<input type=\"submit\" value=\"Try Again\">

</form>

");

}

elseif(strlen($content) < 1){

die("Your can't send an empty message!<br>

<form name=\"back\" action=\"new_message.php\"

method=\"post\">

<input type=\"submit\" value=\"Try Again\">

</form>

");

}

elseif(strlen($title) < 1){

die("You must have a Title!<br>

<form name=\"back\" action=\"new_message.php\"

method=\"post\">

<input type=\"submit\" value=\"Try Again\">

</form>

");

}else{

mysql_query("INSERT INTO messages (from_user, to_user, message_title, message_contents, message_date) VALUES ('$from','$to','$title','$content','$time')") OR die("Could not send the message: <br>".mysql_error()); 

echo "The Message Was Successfully Sent!";

?>

<form name="back" action="inbox.php"

method="post">

<input type="submit" value="Back to The Inbox">

</form>

<?php

}

?>

And if i send message then its says
Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/"user"/public_html/private/messageck.php on line 14
I hope someone can help me to get work this

[carters-site]

This is not returning a result object like you are assuming it should.

PHP Code:

]

mysql_query( $ck_reciever ) 

I assume the mysql connection is happening in database.php.

You should really be checking for a mysql error after a any query you do. It's a good practice to get into. I would check to see what mysql_query is returning here is some code right from php.net that shows how to check for a query problem

PHP Code:

$result = mysql_query('SELECT * WHERE 1=1');

if (!$result) {

    die('Invalid query: ' . mysql_error());

} 

I also want to point out a security hole open for SQL Injection using your method of building the query. You will want to escape that before you just plug username in since you are just plugging that value in from a POST variable.

reference this method built into PHP or switch to use a PEAR Database package.
PHP: mysql_real_escape_string - Manual

[Skiller89]

Still nothing :S
Maybe someone know some another private message script?

[Jcbones]

PHP Code:

<?php
session_start();
require "database.php";

$title=$_POST['message_title'];
$to=$_POST['message_to'];
$content=$_POST['message_content'];
$from=$_POST['message_from'];
$time=$_POST['message_date'];

$ck_reciever = "SELECT username FROM user WHERE username = '".$to."'";
mysql_query($ck_reciever) or die(mysql_error());
        
        if( mysql_affected_rows() == 0 ){
die("The user you are trying to contact don't excist. Please go back and try again.<br>
<form name=\"back\" action=\"new_message.php\"
method=\"post\">
<input type=\"submit\" value=\"Try Again\">
</form>
");
}
elseif(strlen($content) < 1){
die("Your can't send an empty message!<br>
<form name=\"back\" action=\"new_message.php\"
method=\"post\">
<input type=\"submit\" value=\"Try Again\">
</form>
");
}
elseif(strlen($title) < 1){
die("You must have a Title!<br>
<form name=\"back\" action=\"new_message.php\"
method=\"post\">
<input type=\"submit\" value=\"Try Again\">
</form>
");
}else{
mysql_query("INSERT INTO messages (from_user, to_user, message_title, message_contents, message_date) VALUES ('$from','$to','$title','$content','$time')") OR die("Could not send the message: <br>".mysql_error()); 
echo "The Message Was Successfully Sent!";
?>
<form name="back" action="inbox.php"
method="post">
<input type="submit" value="Back to The Inbox">
</form>
<?php
}
?>

Try that, and see what it says. I even left the spelling errors in there for you.

[Nico]

SELECT queries don't return affected rows.

Try:

PHP Code:

$result = mysql_query($ck_reciever) or die(mysql_error());
        
if (mysql_fetch_assoc($result)) { 

And escape your input properly if you want to avoid SQL injections.
PHP: mysql_real_escape_string - Manual

[Skiller89]

Thanks Jcbones, this working now

[Jcbones]

Originally Posted by Nico

SELECT queries don't return affected rows.

Try:

PHP Code:

$result = mysql_query($ck_reciever) or die(mysql_error());

        

if (mysql_fetch_assoc($result)) { 

And escape your input properly if you want to avoid SQL injections.
PHP: mysql_real_escape_string - Manual

Well, learn something new everyday. You are right, it shouldn't (according to the manual), but it does on my test server, and on my public server.