CODEWITHSUNDEEP
phpmysql
DarrenVortex
DarrenVortex

Reputation: 195

Check for username availability php

<?php
$con = mysqli_connect('localhost','root','[mypassword]','dbhwsource');

if(isset($_GET['username'])){
$username = $con->real_escape_string($_GET['username']);
$test = $con->query("SELECT username FROM users WHERE username='$username'");
if($test!=false) die("usererror");
}

if(isset($_GET['email'])){
$email = $con->real_escape_string($_GET['email']);
$test = $con->query("select * from users where email='$email'");
if($test!=false) die("emailerror");
}

$con->close();
echo "ok";
?>

So I'm just trying to check to see if the username / email is available or not, but all i get is "usererror" no matter what the input username is! I'm just frustrated and have searched for sample code everywhere and the code looks like there's nothing wrong with it. What am I doing wrong?

EDIT:

$test = $test->fetch_assoc();
if(!empty($test)) die("usererror");

This worked!

Upvotes: 1

Views: 1905

Answers (5)

DarrenVortex
DarrenVortex

Reputation: 195

This worked for me:

$test = $test->fetch_assoc();
if(!empty($test)) die("usererror");

Upvotes: 0

M K Garwa
M K Garwa

Reputation: 495

Your code is really not secure not optimized anybody can login with sql injection in your code.

and your code is right as you are checking thar (test != false) it means it is true that's why your code og usererror is executing

here is some tips and always use this style for security and optimization

do same for $email

third after running the query do not check if it is true or false but check again after query

if($test->username === $_GET['username']) { do something }

check sql injections on Google why i did this

Upvotes: -1

Mark
Mark

Reputation: 927

I recently did something like this for an android app. you should really check this site out. It helped me tremendously. This is a detailed example of having a PHP API for an aplication. Specifically logging in.

To be specific though, here is a snippet from the page for the PHP

/*
 * Check user is existed or not
 */
public function isUserExisted($email) {
    $result = mysql_query("SELECT email from users WHERE email = '$email'");
    $no_of_rows = mysql_num_rows($result);
    if ($no_of_rows > 0) {
        // user existed
        return true;
    } else {
        // user not existed
        return false;
    }
}

Upvotes: 0

Sudhir Bastakoti
Sudhir Bastakoti

Reputation: 100195

Since your query returns true, this line if($test!=false) die("usererror"); gets executed, should be something like

$test = $con->query("SELECT username FROM users WHERE username='$username'");
$row_cnt = $test->num_rows;
if( $row_cnt > 0 ) { 
  //you already have user with this name, do something 
}

Upvotes: 2

deceze
deceze

Reputation: 522382

$con->query returns a result object if the query was successful. This doesn't say anything about how many rows where found or whether the query matched anything, it just means the query executed successfully. Therefore your $test!=false test always succeeds; only in the case of a database error would it fail.

Do the query as SELECT COUNT(*) FROM ..., then fetch the first row of the result and see if the count is > 0.

Upvotes: 1

Related Questions