Deep Analysis and Solution for "Call to a member function query() on null" Error in PHP

Problem Background and Error Analysis

In PHP development, particularly when handling database operations, developers frequently encounter errors like "Fatal error: Call to a member function query() on null". This error typically indicates that code is attempting to call a method on an object with a null value, and in this specific case, the problem occurs with the $db->query() call.

Code Problem Diagnosis

Let's carefully analyze the issue in the original code. In the provided code snippet, the database connection object $db is created in the global scope:

<?php
$db = new mysqli('127.0.0.1', 'root', '', 'wisconsindairyfarmers');
?>

However, inside the user_exists() function, the code attempts to use this $db object to execute an SQL query:

function user_exists($username){
    $result = $db->query("SELECT COUNT(UserId) FROM users WHERE UserName = '$username'");
    // ... additional code
}

There's a crucial scope issue here. In PHP, functions cannot access externally defined variables by default, unless these variables are declared as global or passed as parameters.

Solution Implementation

According to the best answer's recommendation, the correct solution is to pass the database connection object as a parameter to the function. This approach not only resolves the scope issue but also makes the function more modular and testable.

The modified function definition should look like this:

function user_exists($db, $username){
    // Sanitize username (recommended addition)
    // $username = sanitize($username);
    
    // Prepare SQL statement to prevent SQL injection
    $stmt = $db->prepare("SELECT COUNT(UserId) FROM users WHERE UserName = ?");
    $stmt->bind_param("s", $username);
    $stmt->execute();
    $stmt->bind_result($count);
    $stmt->fetch();
    $stmt->close();
    
    return $count == 1;
}

Correspondingly, the function call also needs to be updated:

if(user_exists($db, $username) === false) {
    echo 'We can\'t find that username.';
}

Understanding Variable Scope in Depth

PHP's variable scope rules are key to understanding this issue. In PHP:

1. Local Variables: Defined inside functions, visible only within those functions
2. Global Variables: Defined outside functions, require the global keyword or $GLOBALS array for access inside functions
3. Superglobal Variables: Such as $_POST, $_GET, etc., available in any scope

While you could use global $db; to access global variables inside functions, passing parameters is generally considered better practice because it:

1. Makes function dependencies more explicit
2. Improves code testability
3. Reduces side effects and unexpected variable modifications

Security Enhancement Recommendations

Beyond solving the basic error, we should also focus on code security. The original code contains SQL injection risks:

$result = $db->query("SELECT COUNT(UserId) FROM users WHERE UserName = '$username'");

If $username contains malicious SQL code, this could lead to serious security issues. Recommended improvements include:

1. Using prepared statements (as shown in the modified code above)
2. Validating and filtering user input
3. Implementing proper error handling mechanisms

Complete Best Practice Example

Here's a complete example integrating all best practices:

<?php
// Database connection
$db = new mysqli('127.0.0.1', 'root', '', 'wisconsindairyfarmers');

// Check connection success
if ($db->connect_error) {
    die("Connection failed: " . $db->connect_error);
}

// User existence check function
function user_exists($db, $username) {
    // Input validation
    if (empty($username) || !is_string($username)) {
        return false;
    }
    
    // Use prepared statements to prevent SQL injection
    $stmt = $db->prepare("SELECT COUNT(UserId) FROM users WHERE UserName = ?");
    if (!$stmt) {
        // Log error
        error_log("Prepare failed: " . $db->error);
        return false;
    }
    
    $stmt->bind_param("s", $username);
    $stmt->execute();
    $stmt->bind_result($count);
    $stmt->fetch();
    $stmt->close();
    
    return $count == 1;
}

// Main logic
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $username = trim($_POST['username'] ?? '');
    $password = $_POST['password'] ?? '';
    
    if (empty($username) || empty($password)) {
        echo 'You need to enter a username and password';
    } elseif (!user_exists($db, $username)) {
        echo 'We can\'t find that username.';
    } else {
        // User exists, continue with password verification, etc.
        // ...
    }
}

// Close database connection
$db->close();
?>

Summary and Best Practices

Through this case study, we can summarize the following best practices for PHP development:

1. Clarify Variable Scope: Always be aware of each variable's scope to avoid accidental cross-scope access
2. Use Parameter Passing: For function dependencies, prefer passing parameters over relying on global variables
3. Implement Input Validation: Strictly validate and filter all user input
4. Use Prepared Statements: Prevent SQL injection attacks
5. Add Error Handling: Include appropriate error handling for database operations and other potentially failing operations
6. Maintain Code Modularity: Keep functions single-responsibility for easier testing and maintenance

Understanding and applying these principles not only solves specific errors like "Call to a member function query() on null" but also significantly improves the quality and security of entire applications.