[PHP MYSQL] Password Changer [Warning: mysql_num_rows() expects parameter 1 to be resource]

Question

I am using simple self-created php script to change password to my wow server's website.
Here's the error:

"Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given in D:\wamp\www\password.php on line 24"

Password script:

if (isset($_POST['submit'])){  
 change_db($realm_DB);  
 $loginusername = "$acc_name";  
 $loginpass = $_POST['password'];  
 $sha_pass_hash = sha1(strtoupper($loginusername) . ":" . strtoupper($loginpass));  
 $qry=mysql_query("UPDATE `$realm_DB`.`account` SET `sha_pass_hash`='$sha_pass_hash', `v`='', `s`='', WHERE (`username`='$loginusername');");  
 if (mysql_num_rows($qry) == 1){  
?>  
  < script type="text/javascript" >  
  {  
   alert("Successfully changed password!");  
  }  
  < /script>  
< ?php  
}  
}  
?> 

I added spaces to script type javascript and php tag just because you could see it.
Anyway I added "or trigger_error(mysql_error().$sql)" after "$qry" to see the sql error.
Here it is:

"Notice: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE (username='ADMIN')' at line 1 in D:\wamp\www\password.php on line 23"

I don't know what causes those errors because I can register and login to my site.
Gief a help!

Answer 1

From looking at it quickly, you have a comma that shouldn't be there just before the WHERE keyword:

s='' , WHERE

Answer 2

I'd suggest that your query is throwing an error (ie you have an invalid SQL string), and therefore the $qry variable is containing FALSE instead of the result object you expect.

You should check for this first. If it is FALSE, you can then use mysql_error() to find what the error actually was. This will help you debug your SQL string.

Answer 3

In your SQL you have a , before your WHERE clause which is invalid.

Also, mysql_query will return true or false for an UPDATE query not a resource. You should use mysql_affected_rows to ensure the row was updated not mysql_num_rows.

Check the documentation for mysql_query