CODEWITHSUNDEEP
phpmysql
Diana
Diana

Reputation: 315

Check existence of a record in MySQL(with PHP)?

I made a small database(1 table) in phpMyAdmin. One of the fields I want to check is "Name". I want to verify through PHP if a name that user types in a form exists in the database. In the html a list of names from DB appears, but the user might type wrong the name in the form. The problem is the answer whether it exists or not varies.

I have 2 PHP files: Connection.php and welcome.php

Connection

 <html> 
 <head>
 <title>Project</title>
 </head>
 <body>

 <?php
 mysql_connect("localhost","root","");
 mysql_select_db("e-card");

 $sql=mysql_query("SELECT * FROM person");
 $dbname="name";
 #$formula_adr="formula_adr";
 #$adress="adr";
 $line=mysql_fetch_assoc($sql);

 echo'Choose a name to whom you send e-card:<br/><br/>';
 echo $line[$dbname].'<br/>';
 while($line=mysql_fetch_assoc($sql))
 echo $line[$dbname].'<br/>';
 ?>
 <form action="welcome.php" method="POST">
 Nume: <input type="text" name="fname" />
 <input type="submit" value="Verify existance in DB"/>
 </form>    
 </body>
 </html>

And welcome:

 <?php
 mysql_connect("localhost","root","");
 mysql_select_db("e-card");

 $sql=mysql_query("SELECT * FROM persoana");
 $dbname="name";
 $formula_adr="formula_adr";
 $adresa="adr";
 $linie=mysql_fetch_assoc($sql);

 if ($_SERVER['REQUEST_METHOD']=='POST' and isset($_POST['fname']))
 {
 $name = $_POST['fname'];

 while($line=mysql_fetch_assoc($sql))
 {
 if(strcmp($name,$line[$dbname]))
 {
 echo 'Found';
 }
 else
 {
 echo 'This name doesn't exist in DB';
 }
 }
 }
 ?>

THANK YOU IN ADVANCE ^_-

Upvotes: 0

Views: 1665

Answers (3)

jamesTheProgrammer
jamesTheProgrammer

Reputation: 1777

I would follow these steps high level steps.

1 - use javascript to initially check on client side that something was entered BEFORE calling the DB. You can use a filter in your javascript to check that form field.

2 - If you verify that something *useful was entered - pass the form field value to another page or object that will parse the value and then query the table.

3 - Use the parsed value against the db table column that contains your data. If records are found, return them.

Use a SQL injection technique to prevent malicious intend by users who may type something evil into your form field.

Upvotes: 1

Chaney Blu
Chaney Blu

Reputation: 343

<?php
mysql_connect(HOST, USERNAME, PASSWORD);
mysql_select_db(DB_NAME);

if($_POST) {
    $name = $_POST['fname'];

    // check if name exists in db
    $sql = "SELECT name FROM person WHERE name=' . mysql_real_escape_string($name) . '";
    $query = mysql_query($sql);

    if(mysql_num_rows($query) > 0) {
        // user exists
    } else {
        // user does not exist
    }
}

The above script will work and will also protect your script against SQL injection by using the built-in mysql_real_escape_string method. I would also recommend against using a wildcard (*) selector when verifying data in this manner as it's a waste of resources to query any additional information that is unused.

Upvotes: 2

Petar Sabev
Petar Sabev

Reputation: 858

Don't get all data from the table to compare for a name. Do it this way:

$sql=mysql_query("SELECT * FROM persoana where name like '$name%'");

You will get result only if you have a match

Upvotes: 0

Related Questions