php - SA:MP UCP login error -

i developing user control panel sa:mp server. working on login script @ moment have come across following error:

catchable fatal error: object of class mysqli_result not converted string in /var/www/html/login.php on line 21

login.php:

session_start();  if(!isset($_session["user"])) {     echo 'username: '.$_post['username'].'.';     echo '<br>password: '.$_post['password'].'.';     $szuser = sanitize($_post['username']);     $szpass = sanitize($_post['password']);     echo '<br>username santizied: '.$szuser.'.';     echo '<br>password santizied & hashed: '.strtoupper(hash("whirlpool", $szpass)).'.';     //exit();     echo "<br>" . date('h:i:s');     echo '<br>logging in, please wait...';     echo "<br>select * `accounts` `username` = '".$szuser."' limit 1";     $query = "select * `accounts` `username` = '".$szuser."' limit 1";     echo "<br>\$result = mysqli_query(\$connection, \"$query\");";     $result = mysqli_query($connection, $query);// line 21.     echo "<br>mysqli_num_rows($result) == " . mysqli_num_rows($result) . ".";     if(mysqli_num_rows($result) == 1)     {         echo "<br>while(\$row = mysqli_fetch_array(\$result, mysqli_assoc))";         while($row = mysqli_fetch_array($result, mysqli_assoc))         {             echo "<br>username = ".$row["username"].".";             if($szpass == strtoupper(hash("whirlpool", $szpass)))             {                 $_session["user"] = $row["id"];                 echo '<meta http-equiv="refresh" content="0; url=index.php?page=home" />';             }             else echo '<meta http-equiv="refresh" content="0; url=index.php?page=login&error=2" />';         }     }     else echo '<meta http-equiv="refresh" content="0; url=index.php?page=login&error=1" />';     echo "<br>login.php ended";     echo date('h:i:s'); } else echo '<meta http-equiv="refresh" content="0; url=index.php?page=home" />'; exit(); ?> 

mysql.php:

$host = "localhost"; $database = "sasrp"; $password = "censored"; $user = "usrsamp";  if($user == "root") {     die("<strong>error:</strong> can't connect mysql server.<br/><strong>reason:</strong> root logins not authorised."); }  $connection = mysqli_connect($host, $user, $password, $database) or die("<strong>error:</strong> can't connect mysql server.<br/><strong>reason:</strong> login credentials incorrect.");  ini_set('display_errors', 1); error_reporting(e_all);  if (mysqli_connect_errno())  {     echo "failed connect mysql: " . mysqli_connect_error(); }   //mysqli_set_charset($link, "utf-8"); function sanitize($string) // function sanitize xss , mysql , csrf. {      $string = trim($string);     $string = stripslashes($string);     $string = htmlspecialchars($string);     return $string; }  function getusername($sqlid) {     $szquery = 'select `username` `accounts` `id` = '.$sqlid.' limit 1';      $iresult = mysqli_query($szquery);     while($irow = mysqli_fetch_array($iresult))     {         echo $row['username'];     } }  /*function getip()  {      $ip;      if (getenv("http_client_ip"))      $ip = getenv("http_client_ip");      else if(getenv("http_x_forwarded_for"))      $ip = getenv("http_x_forwarded_for");      else if(getenv("remote_addr"))      $ip = getenv("remote_addr");      else      $ip = "unknown";     return $ip;  }*/ ?> 

as can see, i've heavily debugged login.php script. assistance appreciated, thanks. sean mcelholm.

first off, problem line

echo "<br>mysqli_num_rows($result) == " . mysqli_num_rows($result) . "."; 

change to

echo "<br>mysqli_num_rows(\$result) == " . mysqli_num_rows($result) . "."; 

now complaints:

$szuser = sanitize($_post['username']); $szpass = sanitize($_post['password']); 

remember sanitizing html, , sanitizing sql query, not same thing, thus, if you're not simultaneously sanitizing both (which doubt), you're opening site either xss/javascript injection attacks (if sanitize sql, believe case), or sql injection attacks (if sanitize html) ; also, im guessing sanitize sql, make sure sanitize function use exact same escape rules database connection? (this depends on db , character set on connection db..) should use mysqli_real_escape_string , htmlentities , not sanitize() (whatever is)

echo '<br>username santizied: '.$szuser.'.'; 

should use

echo '<br>username santizied: '.htmlentities($szuser,ent_substitute).'.'; 

also

$szuser = sanitize($_post['username']); 

should be

$szuser = mysqli_real_escape_string($connection,$_post['username']); 

also

echo '<br>password santizied & hashed: '.strtoupper(hash("whirlpool", $szpass)).'.'; 

just unsalted hashing whirlpool not secure way store passwords, can bruteforced weak passwords, or even lookup tables strong password, consider using http://php.net/manual/en/function.password-hash.php , or salting scheme.

        echo "<br>username = ".$row["username"]."."; 

again, should use htmlentities (unless store usernames in html-compatible format.. doubt)

..also, consider using prepared statements , parameterized queries, it's faster , less error-prone mysqli_real_escape_string (though won't explain why)