Php Error Help

[Fallin-Again]

I cant figure out why I am getting this error: Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/teach/public_html/included/query.php on line 7

I have tried re-writting the first query and still no luck. Here is my code:

<?php
include("/home/teach/public_html/included/db_config.php");
echo("Loading<br /><br />");
$query1 = mysql_query("SELECT * FROM `TABLE 91` ORDER BY `SKU` DESC") or die("Q1: ".mysql_error());
if(mysql_error() == ""){

	while($qArray = mysql_fetch_array($query1)){
		
		$productModel = $qArray['SKU'];
		$productUPC = $qArray['UPC'];
		
		$query1 = mysql_query("UPDATE `products` SET `products_upc` = '$productUPC' WHERE `products_model` = '$productModel' LIMIT 1") or die("Q2: ".mysql_error());
		
		$productModel = "";
		$productUPC = "";
		
	}
}
?>

[Fallin-Again]

Never mind, I figured out the problem. I had given the second query the same variable name as the first.

[VigilanteNighthawk]

Two points:
1) I would really suggest dropping the mysql extension and use either PDO or mysqli, preferable with prepared queires.
2) I would NOT display the msyql_error string on failure. It gives information on your database that can be exploited by attackers. Write it to a log file instead.

[Diki]

At 11/3/12 08:12 PM, VigilanteNighthawk wrote: 1) I would really suggest dropping the mysql extension and use either PDO or mysqli, preferable with prepared queires.

This is very true, and really, unless your PHP version doesn't support them, just use PDOs. The mysqli_* functions are going to be deprecated soon. Parameterised statements are a very good idea too.

At 11/3/12 08:12 PM, VigilanteNighthawk wrote: 2) I would NOT display the msyql_error string on failure. It gives information on your database that can be exploited by attackers. Write it to a log file instead.

Outputting errors directly to the browser is fine to do if it's done in a dev environment, but in production Vigilante is correct: write that to a log file. Errors should never be displayed in production.