CODEWITHSUNDEEP
phpsqldatabase
seb
seb

Reputation: 21

PHP data retrieving problem in database

Ok so the problem is... i m a newbie and i m trying to understand what is happening.Im sending through an html form this data(name,email) using POST in a database.I understand the logic behind it all but what basically happens is that everytime I enter a name,any name,it echoes the else statement:"there is already a user with that name". and it sends back the first name in the database.when there s nothing,it sends nothing. So here's the chunk:

 $query= "SELECT* from users where username='".$_POST['name']."'";
        $result = mysql_query($query);
        if (!$result){


        $query = "INSERT into users (username, email, password) values
        ('".$_POST["name"]."', '".$_POST["email"]."',  
        '".$passwords[0]."')";
        $result = mysql_query($query);

        if ($result){
            echo "It's entered!";
        } else {
            echo "There's been a problem: ".mysql_error();
        }
     } else {

         echo "There is already a user with that name: <br />";
        $sqlAll = "select * from users";
         $resultsAll = mysql_query($sqlAll);
         $row = mysql_fetch_array($resultsAll);
           while ($row) {

              echo $row["username"]." -- ".$row["email"]."<br />";

           $row = mysql_fetch_array($result);

Upvotes: 2

Views: 314

Answers (5)

code_burgar
code_burgar

Reputation: 12323

First of all, you are testing for:

if (!$result)

which will evaluate to true only if the query fails.

You should also sanitize all input before using it in SQL queries.

Upvotes: 0

heximal
heximal

Reputation: 10517

see no violation in your code. first mysql_query executes with no error and always returns true. try to test returned rows count like this:

if (mysql_num_rows($result) == 0) {
//insert record
} else {
// show alreay exists
}

Upvotes: 1

Layke
Layke

Reputation: 53166

ESCAPEEEEE

Firstly, you need to learn about escaping. Have you never heard of little Johnny DROP TABLES?

http://xkcd.com/327/

Serious business

The reason why it always returns, is because the response in $result is actually a resource data type. And that will always when cast as a boolean be true. (And since your query shouldn't fail).

You should fetch the result. For example. (This isn't the best way, but it is a way to do it).

mysql_fetch_row(result)

Upvotes: 2

robertlbolton
robertlbolton

Reputation: 168

Per the manual, mysql_query will return false when there is an error - "For SELECT, SHOW, DESCRIBE, EXPLAIN and other statements returning resultset, mysql_query() returns a resource on success, or FALSE on error."

Upvotes: 1

preinheimer
preinheimer

Reputation: 3722

You may want to check mysql_num_rows() rather than checking for !$result, I think that if the query is sucsesfull you'll get a resource back, even though it contains zero rows.

You may also want to read up on: http://php.net/manual/en/security.database.sql-injection.php

Upvotes: 2

Related Questions