1

I building an website and when i insert data in database it works but when i try to insert again,i want to give me error,for example if the data that i inserted before its the same off the data that im inserting now, i want to stay in the same page.And if i never inserted that data i want to insert in databse.

<?php
include_once 'dbconfig.php';
if($_POST){
$descricao = $_POST['descricao'];
$tipo_divisao = $_POST['tipo_divisao'];


$sql_query = "SELECT descricao FROM divisao WHERE descricao ='$descricao'";
$consulta = mysqli_query($link,$sql_query);

if(mysqli_num_rows($consulta)==1){
 header("Location: Add_Divisao.html");
 exit;
}else{
  $sqlite_query = "INSERT INTO divisao(descricao,Tipo_Divisao,cenario) VALUES ('$descricao','$tipo_divisao',72)";
  mysqli_query($link, $sqlite_query);
  header("Location: Confirm_Divisao_Dispo.html");
  exit;
}
}
?>
Fabio Gonçalves
  • 73
  • 8
  • You are mixing apis `mysqli`/`mysql` -> `mysqli_query` vs `mysql_num_rows` – Sean Jan 21 '17 at 00:37
  • also, now is a good time to read up on [How can I prevent SQL injection in PHP?](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) – Sean Jan 21 '17 at 00:38
  • Thanks for the answer but what should i do? – Fabio Gonçalves Jan 21 '17 at 00:38
  • Your code is wide open to [SQL Injection](http://stackoverflow.com/documentation/php/5828/pdo/2685/preventing-sql-injection-with-parameterized-queries). Switch to using [prepared statements](http://stackoverflow.com/documentation/php/2784/php-mysqli/11958/prepared-statements-in-mysqli) and you should resolve this problem – Machavity Jan 21 '17 at 00:38
  • change `mysql_num_rows()` to `mysqli_num_rows()` – Sean Jan 21 '17 at 00:38
  • Its the same if i put what u suggested – Fabio Gonçalves Jan 21 '17 at 00:43
  • Change if(mysqli_num_rows($consulta)==1) to if(mysqli_num_rows($consulta) > 0 ) and see if that helps. –  Jan 21 '17 at 01:04
  • It worked thanks! and how can i do to show an error? – Fabio Gonçalves Jan 21 '17 at 01:10

0 Answers0