mysqli 错误 - 获取数组期望参数为 1，给定字符串

为什么这不起作用？我使用了一个教程来做到这一点。

// FETCH DATA FROM INPUT FIELD
$user = mysqli_real_escape_string($db2, $_POST['user']);
$pass = mysqli_real_escape_string($db2, $_POST['pass']);
  // CHECK ALL FIELD HAS BEEN FILLED UP
 if ($user && $pass) {
       // QUERY FROM DATABASE
  $query= mysqli_query($db2, "SELECT * FROM members WHERE username='".$user."'");
  $checkuser= mysqli_num_rows($query);
   // CHECK IF USERNAME EXIST ON DATABASE
  if($checkuser != 1) {
    // I'LL BE SETTING A VARIABLE IF YOUR DOESN'T EXIST
   $error = "Username doesn't exist in our database!";
  }
   // FETCHING PASSWORD IN DATABASE WHERE USERNAME COINCIDES
 while  ($row = mysqli_fetch_array($user)) {
   $checkpass= $row['password'];

    // CHECK IF ENTERED PASSWORD MEETS THE USERNAME PASSWORD
   if ($pass== $checkpass) {
     // IF ALL OKAY SET SESSION
    setcookie("user", $user, time()+7200);
    $_SESSION['user'] = $user;
    $_SESSION['start'] = time();
    $_SESSION['expire'] = $_SESSION['start'] + (60 * 60 * 60);
    header("Location: ".$_SERVER['PHP_SELF']);
    exit();
   } else {
     // SET VARIABLE THAT'LL SHOW IF USER PASSWORD IS INCORRECT
    $error = "Incorrect password!";
   }
  }
 } else {
  // SET VARIABLE IF ALL FIELD ARE NOT FILLED UP
 $error = "Please enter a username and password.";
 }
}
?>