0

I have this PHP code that selects one simple value:

$name = $mysqli->query('SELECT name FROM users WHERE id = ' . $id . ' LIMIT 1')->fetch_object()->name;

Now if the result is 0, it throws an error.

I want instead to return a default value like "No name" if there are no results.

Any suggestions?

7
  • 3
    What about if ($result == null) return 'No Name'; before you fetch_object() Commented Jan 27, 2017 at 14:10
  • 1
    Query first, check for result. If result return it, if not send your default.
    – chris85
    Commented Jan 27, 2017 at 14:13
  • 1
    SELECT IFNULL(name, 'no name') FROM...
    – McNets
    Commented Jan 27, 2017 at 14:14
  • 2
    @McNets although this seems as a good idea to get default value, if non present, it won't solve the error, where there is no data to return at all. it's not that the name field has no value, there is just no return.
    – Peon
    Commented Jan 27, 2017 at 14:17
  • 3
    However, your code stands to be open to an SQL injection, and all answers so far won't safeguard you against it. Use a prepared statement and check if the row exists while binding the result(s) as per stackoverflow.com/questions/22252904/… and base yourself on that and with a ternary operator or if/else. Commented Jan 27, 2017 at 14:30

3 Answers 3

6

Don't fetch the name directly, instead check, if there is data in it first. Something like this should work:

$result = $mysqli->query('SELECT name FROM users WHERE id = ' . $id . ' LIMIT 1')->fetch_object();

$name = (!$result) ? 'No name' : $result->name;

Additional, as @RiggsFolly mentioned, it is suggested to use prepared statements, to reduce SQL possibilities:

$stmt = $mysqli->prepare("SELECT name FROM users WHERE id = ? LIMIT 1");
$stmt->bind_param('i',$id);
$stmt->execute();
$result = $stmt->get_result()->fetch_object();
1
3

This can be done in pure SQL so that you wouldn't need any extra line of PHP code :

$name = $mysqli->query('SELECT IFNULL((SELECT name FROM users WHERE id = ' . $id . ' LIMIT 1), "No Name") name')->fetch_object()->name;
4
  • 2
    Upvoting for the SQL solution. Although I think this is better done at the application layer since it's much more clear what is happening (and that's coming from a database guy).
    – JNevill
    Commented Jan 27, 2017 at 14:19
  • 1
    I agree with you, Dainis Abols's solution is what I would have done too. The reason for that is that I don't want the exact same behaviour for my app in the two cases of user found or user not found, while in this solution, if I have a user named "No Name" I have absolutely no way in the app level to determine if I am in the case of no user found or not. But sometimes that could be exactly what you want : having an app that acts the exact same in the two situations.
    – Mouradif
    Commented Jan 27, 2017 at 14:23
  • 1
    SQL Injection Attack Have a look at what happened to Little Bobby Tables Even if you are escaping inputs, its not safe! Use prepared parameterized statements
    – RiggsFolly
    Commented Jan 27, 2017 at 14:36
  • @RiggsFolly : if my query is under a if (is_numeric($id)) which seems to be the case since there are no quotes around $id I have absolutely nothing to fear. But thanks.
    – Mouradif
    Commented Jan 27, 2017 at 14:50
1

Try this, with prepared statement:

$result = $mysqli->prepare('SELECT name FROM users WHERE id = ? LIMIT 1');
$result->bind_param("i", $id);
$result->execute();
$result->bind_result($col1);
$result->fetch();
$name = (!$col1) ? 'No name' : $col1;
echo $name;
$result->close();

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.