Database Connection with SQLSRV drivers in OOP without PDO

Question

I am trying to make an OOP login system for my website and am having real trouble connecting to the MS SQL database, so falling at the first hurdle really!

I am using the SQLSRV drivers and installing PDO is not an option. I am getting the following error which I understand to mean that the connection is not being established and the db_connection variable is null:

Fatal Error Call to a member function set_charset() on a non-object in C:\xxxx\auth.php on line 79

class Auth
{

/**
 *  @var string - database connection
 */
private $db_connection = null;

/**
 * @var array - collection of error messages
 */
public $errors = array();

/**
 * @var array - collection of success / neutral messages
 */
public $messages = array();


public function __construct()
{
    // create/read session, absolutely necessary
    session_start();

    // check the possible login actions:
    // if user tried to log out (happen when user clicks logout button)
    if (isset($_GET["logout"])) {
        $this->doLogout();
    }
    // login via post data (if user just submitted a login form)
    elseif (isset($_POST["auth"])) {
        $this->doauthWithPostData();
    }
}



// AUTHENTICATE
private function doauthWithPostData()
{

    $serverName = "%server%";
    $User = "%user%";
    $Pass = "%pwd%";
    $DB = "%dbname%";


    $connectionInfo = array( "Database"=>$DB, "UID"=>$User, "PWD"=>$Pass);


    // check login form contents
    if (empty($_POST['usr'])) {
        $this->errors[] = "Username field was empty.";
    } elseif (empty($_POST['usr_pwd'])) {
        $this->errors[] = "Password field was empty.";
    } elseif (!empty($_POST['usr']) && !empty($_POST['usr_pwd'])) {

        // create a database connection, using the constants from db.php (loaded in index.php)
        $this->db_connection = sqlsrv_connect( $serverName, $connectionInfo);
        //$this->db_connection = new mssql_connect(constant(DB_HOST), constant(DB_USER), constant(DB_PASS));

        // change character set to utf8 and check it
         if (!$this->db_connection->set_charset("utf8")) {
            $this->errors[] = $this->db_connection->error;
         }

        // if no connection errors (= working database connection)
         if (!$this->db_connection->connect_errno) {

        // escape the POST stuff
             $user_name = $this->db_connection->ms_escape_string($_POST['user_name']);

           // database query, get all the info of the selected organisation
            $qry = "SELECT USR, PASSWORD
                    FROM USERS
                    WHERE USR = '" . $_POST['usr'] . "';";
            $result_of_auth_check = $this->db_connection->query($qry);

            // if this org exists
            if ($result_of_auth_check->num_rows == 1) {

                // get result row (as an object)
                $result_row = $result_of_auth_check->fetch_object();

                // password_verify() function to check if the provided password fits
                // the hash of that user's password
                if (password_verify($_POST['usr_pwd'], $result_row->user_password_hash)) {

                    // write user data into PHP SESSION
                    $_SESSION['user_auth_status'] = $_POST['usr'];

                } else {
                    $this->errors[] = "Wrong password. Try again.";
                }
            } else {
                $this->errors[] = "This user does not exist.";
            }
        } else {
            $this->errors[] = "There was a problem connecting to the database.";
        }
    }
}

I have tried making the connection in exactly the same way outside of OOP and it works just fine. I don't see what is going wrong! Thanks for any help, really appreciated!

Answer 1

sqlsrv doesn't have a function called set_charset. Instead, this option can be set in connection parameters array like:

$connectionInfo = array(
   "Database"     => $DB,
   "UID"          => $User,
   "PWD"          => $Pass,
   "CharacterSet" => "UTF-8"
);

And checking changes to:

...
if (!$this->db_connection) {
   // You can modify here however you like
   $this->errors[] = print_r(sqlsrv_errors(), true);
}

You should also remove second check, because we are doing it with the code above:

// if no connection errors (= working database connection) if (!$this->db_connection->connect_errno) { ...

There seems more error in your code like sqlsrv doesn't have a function like ms_escape_string also. You should check official documentation more.

Answer 2

Use sqlsrv_errors() to get a clearer idea of the problem. I'd guess you don't have the SQL Native Client installed.