0

I tried to create a register login feature in Android app. I tried to send data from my app to database by using this Php file. However, I received br/ error when I clicked register button on my app. Look like mysqli_fetch_array is not working. Anyone know how to solve this problem? Thanks!

<?php
if($_SERVER['REQUEST_METHOD']=='POST'){
    $name = $_POST['name'];
    $username = $_POST['username'];
    $password = $_POST['password'];
    $email = $_POST['email'];

    if($name == '' || $username == '' || $password == '' || $email == ''){
        echo 'please fill all values';
    }else{
        require_once('dbConnect.php');
        $sql = "SELECT * FROM users WHERE username='$username' OR email='$email'";          
        $result=mysqli_query($con,$sql);
        $check = mysqli_fetch_array($result,MYSQLI_BOTH);   
        if(isset($check)){      
            echo 'username or email already exist';
        }else{          
            $sql = "INSERT INTO users (name,username,password,email) VALUES('$name','$username','$password','$email')";
            if(mysqli_query($con,$sql)){
                echo 'successfully registered';
            }else{
                echo 'oops! Please try again!';
            }
        }
        mysqli_close($con);
    }
 } else{
echo 'error';
}

dbConnect.php

<?php
 define('HOST','localhost');
 define('USER','username');
 define('PASS','password');
 define('DB','database');

 $con = mysqli_connect(HOST,USER,PASS,DB) or die('Unable to Connect');
Qianonn Phoon
  • 73
  • 4
  • 14
  • You're at risk for SQL injection... – wogsland Feb 02 '17 at 02:16
  • 1
    Your script is at risk of [SQL Injection Attack](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Have a look at what happened to [Little Bobby Tables](http://bobby-tables.com/) Even [if you are escaping inputs, its not safe!](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) Use [prepared parameterized statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). – John Conde Feb 02 '17 at 02:16
  • what do you see now, `error`? – Funk Forty Niner Feb 02 '17 at 02:17
  • 2
    I love it when they don't answer or just leave. Sorry, no magic wand waving for you; debug your code. – Funk Forty Niner Feb 02 '17 at 02:22
  • From your explaination, it's difficult to narrow down the exact cause. Are you sure its the mysqli_fetch_array? After a quick check on the "isset" php documentation, it doenst seem you can simply check is an array has values, but you can check if a element in the array has a value. Maybe try the following: "isset($check[0])" – binaryNomad Feb 02 '17 at 02:29
  • @Fred-ii- I get
    when I clicked register
    – Qianonn Phoon Feb 02 '17 at 03:05
  • Can you share your dbConnect.php file? – Saravanan Sampathkumar Feb 02 '17 at 03:06
  • @Juicebox I add echo 't1'; at top of $check = mysqli_fetch_array and echo 't2'; at bottom of mysqli_fetch_array. Eventually, it only return me t1. So, is it mean mysqli_fetch_array is not working? – Qianonn Phoon Feb 02 '17 at 03:08
  • @SaravananSampathkumar dbConnect.php added – Qianonn Phoon Feb 02 '17 at 03:12
  • **WARNING**: Writing your own access control layer is not easy and there are many opportunities to get it severely wrong. This has many dangerous [SQL injection vulnerabilities](http://bobby-tables.com/) since you didn’t [properly escape values](http://bobby-tables.com/php). This code allows *anyone* to get *anything* from your site. **DO NOT** write your own authentication system. Any [development framework](http://codegeekz.com/best-php-frameworks-for-developers/) like [Laravel](http://laravel.com/) comes with an [authentication system](https://laravel.com/docs/5.3/authentication) built-in. – tadman Feb 02 '17 at 04:02
  • **WARNING**: Please, follow [recommended security best practices](http://www.phptherightway.com/#security) and **never store passwords as plain-text**. – tadman Feb 02 '17 at 04:03
  • 1
    @tadman Thanks, I will go and try Laravel – Qianonn Phoon Feb 02 '17 at 05:16

1 Answers1

0

I think you should remove isset check. It'll always return true no matter what. Do count check instead.

if(count($check)){      
    echo 'username or email already exist';
}else{          
    $sql = "INSERT INTO users (name,username,password,email) VALUES('$name','$username','$password','$email')";
    if(mysqli_query($con,$sql)){
        echo 'successfully registered';
    }else{
        echo 'oops! Please try again!';
    }
}
Saravanan Sampathkumar
  • 3,201
  • 1
  • 20
  • 46