PHP + Mysqli functions

Question

I created a function in php to the cruid in the database however function Read is in trouble and I can’t understand why, follow the code:

function DBRead($table,  $params = null, $fields = "*"){
    $table  = DB_PREFIX . '_' . $table;
    $params = ($params) ? " {$params}" : null;

    $query  = "SELECT {$fields} FROM {$table}{$params}";
    $result = DBExecute($query);

    if(!mysqli_num_rows($result))
        return $query;
    else{
        while ($rs = mysqli_fetch_assoc($result)){
            $data[] =$rs;
        }
        return $data;
    }
}

DB_PREFIX is a constant only to assist in the selection of the table in the database, the line I am trying to run is this:

    $chekDouble = DBRead('postagem', "WHERE titulo = '" . $form['titulo'] . "'" );

I debug with var_dump() and the way out is :

'SELECT * FROM mg_postagem WHERE titulo = 'titulo''

that SELECT checks if the title that the user is entering is already the title of some other post in the database, but he always returnstrue Obs: database is empty...

if( $chekDouble )
            echo 'Titulo de Post Já cadastrado!';
        else{

            if(DBCreate('postagem',$form))

Titule provides a form and I use the method $_POST, for the insertion function are passed by table name parameters, and a array of fields and values. that’s the array.

$form['titulo'] = strip_tags( trim( $_POST['titulo'] ) );
$form['bloco1'] = strip_tags( trim( $_POST['bloco1'] ) );
$form['bloco2'] = trim( $_POST['bloco2'] );
$form['datapost']= date("Y-m-d");

Obs: the function works when using that way:

$teste = DBRead('postagem', "teste" );

who executes all the query is:

function DBExecute($query){
    $link   = DBConnect();
    $result = @mysqli_query($link,$query) or die(mysqli_error($link));

    DBClose($link);
    return $result;
}

Answer 1

The problem seems to be that your query fails because of a syntax error because it has the if which is always rated as true.

When mounting your query make sure to space the clasps

$query  = "SELECT {$fields} FROM {$table}{$params}";
//Adicione um espaço aqui --------------^

if(!mysqli_num_rows($result))
    return $query;// mude por return false;

Instead of returning a string with some text (sql query) that will be evaluated as true no if, just return false, an idea is to create another function that logs the queries generated by dbRead() before the return false.

With this change, if should work as expected:

$chekDouble = DBRead('postagem', "WHERE titulo = '" . $form['titulo'] . "'" );

if( $chekDouble )
   echo 'Titulo de Post Já cadastrado!';
else{
  if(DBCreate('postagem',$form))