Foreach loop using $wpdb not results from rows

Question

I'm using $wpdb to develop a plugin to check for some row fields to see if they match and echo true or false. My original code was working when it was a separate mysql DB and accessed that way. As its within wordpress plugin i needed to use $wpdb.

Im selecting from a separate table ( ipn_data_tbl ) and the wpdb prefix gets appended correctly. I want to check each row in that table and match where the item_name and payer_email are check from a software that gets activated. It all worked on stand alone DB outside of wordpress but now i've added the $wpdb (incorrectly?) its not working.

I don't think i am using it correct..any ideas? :

<?php



require_once( $_SERVER['DOCUMENT_ROOT'] . '/wp-load.php' );
    $ipn_table = $wpdb->prefix ."ipn_data_tbl";


   global $wpdb,$ipONactivate,$ipn_table;



$sql = "SELECT * FROM `$ipn_table` WHERE `item_name` = '$product' && `payer_email` = '$serial'";
$result = $wpdb->get_results($sql)or die(mysql_error());  //$wpdb->get_results

    if ($result->num_rows != 0) {
        foreach($result as $row){

        if ($row[`item_name`] == $product && $row[`payer_email`] == $serial) {
            echo true;
             } else {
            echo false;
                    }
                }
            }

?>

Answer 1

First of all, you should never concatenate SQL Query with any variables this way - it will cause SQL Injection vulnerability.

Also... get_results method returns just an array of results. You can’t use it as an object and get num_rows from it - there is no such property in an array (it’s a property of WPDB object).

Another problem is that by default get_results will return selected rows in object format, not as arrays.

So here’s the fixed code:

<?php
    require_once( $_SERVER['DOCUMENT_ROOT'] . '/wp-load.php' );

    global $wpdb, $ipONactivate;

    $ipn_table = $wpdb->prefix ."ipn_data_tbl";

    $result = $wpdb->get_results( $wpdb->prepare(
        "SELECT * FROM {$ipn_table} WHERE item_name = %s AND payer_email = %s",
        $product, $serial
    ) );

    if ( ! empty( $result ) ) {
        foreach($result as $row) {

            if ($row->item_name == $product && $row->payer_email == $serial) {
                echo true;
            } else {
                echo false;
            }
        }
    }
?>

BTW. You can trust the SQL. If you select only rows that has given product and serial, then you don’t have to loop through them and check if they are equal to given values.