0

Basically, what I'm trying to do is to validate the values entered by the user as he registers into the system. When he clicks on the submit button, the data goes into a script that processes the information and when he finds that the username and email is already taken, he is taken back into the same page but the $_POST values are retained.

The problem is, when I modify the values in the username and email field, it still thinks gives me an error that the username and email is already taken when I checked the database, it's not.

Here's my code:

<form method="POST" autocomplete="off" enctype="multipart/form-data">
<?php include '../../includes/backend/register.php'; ?>
    <label for="">First Name:</label>
    <input type="text" class="form-control" name="fname" required placeholder="ex. John" onkeyup="this.value=this.value.replace(/[^a-zA-Z ]/g,'');" value="<?php echo isset($_POST[" fname "]) ? $_POST["fname "] : ''; ?>">
    <label for="">Last Name:</label>
    <input type="text" class="form-control" name="lname" required placeholder="ex. Doe" onkeyup="this.value=this.value.replace(/[^a-zA-Z -]/g,'');" value="<?php echo isset($_POST[" lname "]) ? $_POST["lname "] : ''; ?>" ">
                <label for=" ">Phone:</label>
                <input type="number " class="form-control " name="phone " required placeholder="ex. 09351231234 " onkeyup="this.value=this.value.replace([0-9], ''); " value="<?php echo isset($_POST[ "phone"]) ? $_POST[ "phone"] : ''; ?>"">
    <label for="">Address:</label>
    <input type="text" name="address" list="citynames" class="form-control" placeholder="ex. Dumaguete" autocomplete="on" value="<?php echo isset($_POST[" address "]) ? $_POST["address "] : ''; ?>">
    <datalist id="citynames">
        <option value="Amlan">Amlan</option>
        <option value="Ayungon">Ayungon</option>
        <option value="Bacong">Bacong</option>
        <option value="Bais City">Bais City</option>
        <option value="Basay">Basay</option>
        <option value="Bayawan">Bayawan</option>
        <option value="Bindoy">Bindoy</option>
        <option value="Canlaon City">Canlaon City</option>
        <option value="Dauin">Dauin</option>
        <option value="Dumaguete City">Dumaguete City</option>
        <option value="Guihulngan">Guihulngan</option>
        <option value="Jimalalud">Jimalalud</option>
        <option value="La Libertad">La Libertad</option>
        <option value="Mabinay">Mabinay</option>
        <option value="Manjuyod">Manjuyod</option>
        <option value="Pamplona">Pamplona</option>
        <option value="San Jose">San Jose</option>
        <option value="Siaton">Siaton</option>
        <option value="Sibulan">Sibulan</option>
        <option value="Sta. Catalina">Sta. Catalina</option>
        <option value="Tanjay">Tanjay</option>
        <option value="Tayasan">Tayasan</option>
        <option value="Valencia">Valencia</option>
        <option value="Vallehermoso">Vallehermoso</option>
        <option value="Zamboanguita">Zamboanguita</option>
    </datalist>
    <label for="">Username:</label>
    <input type="text" class="form-control" name="username" required placeholder="ex. johndoe29" value="<?php echo isset($_POST[" username "]) ? $_POST["username "] : ''; ?>">
    <label for="">Email:</label>
    <input type="email" class="form-control" name="email" required placeholder="ex. jdoe@domain.com" autocomplete="off" value="<?php echo isset($_POST[" email "]) ? $_POST["email "] : ''; ?>">
    <label for="">Password:</label>
    <input type="password" class="form-control" name="match" min="6" required placeholder="*******" id="p1">

    <label for="">Confirm Password:</label>
    <input type="password" class="form-control" name="password" min="6" required placeholder="*******" id="p2" onchange="confirm()">
    <p class="note" style="visibility: hidden; font-size: 11px; color: red; margin-top: 2px;">Password does not match</p>

    <label for="">Profile Image:</label>
    <input type="file" class="form-control" name="image" required>

    <input type="Submit" name="submit" value="Register" class="btn btn-primary" id="submit">

My backend:

    if (isset($_POST['submit'])) {
    $fname = mysqli_real_escape_string($con, $_POST['fname']);
    $lname = mysqli_real_escape_string($con, $_POST['lname']);
    $phone = mysqli_real_escape_string($con, $_POST['phone']);
    $address = mysqli_real_escape_string($con, $_POST['address']);
    $username = mysqli_real_escape_string($con, $_POST['username']);
    $email = $_POST['email'];
    $password = $_POST['password'];
    $image = $_FILES['image']['name'];
    $temp = $_FILES['image']['tmp_name'];
    $rand = rand(1, 1000000);
    $loc = "assets/images/users/$rand.$image";
    move_uploaded_file($temp, "../../assets/images/users/$rand.$image");

    $r_user = mysqli_query($con, "SELECT username FROM user WHERE username = '$username'");
    $r_email = mysqli_query($con, "SELECT email FROM user WHERE email = '$email'");

    if ($r_user) {
        echo "That username is already taken<br>";
    }

    if ($r_email) {
        echo "That email is already taken<br>";
    }

    if (!$r_user && !$r_email) {
        mysqli_query($con, "INSERT INTO `user` (`id`, `fname`, `lname`, `phone`, `address`, `username`, `email`, `image`, `password`) VALUES (NULL, '$fname', '$lname', '$phone', '$address', '$username', '$email', '$loc', '$password')");
        header("Location: welcome.php");
    }
}
thraxxdv
  • 3
  • 3
  • `mysqli_query` returns true or false. It's returning true because the query is valid.Check for the rows using `mysqli_num_rows` – Rotimi Oct 26 '17 at 15:00
  • change it to `if ($r_email === TRUE && /*some expersion to make sure*/)` and `if ($r_email === TRUE /*some expersion to make sure*/) {` or use another function like Akintunde – Mohamed Mo Kawsara Oct 26 '17 at 15:01
  • Don't rely on `mysqli_real_escape_string()` to prevent SQL injection, [it alone is not sufficient](https://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string). You should use prepared statements with bound parameters, via either the [**mysqli**](https://secure.php.net/manual/en/mysqli.prepare.php) or [**PDO**](https://secure.php.net/manual/en/pdo.prepared-statements.php) drivers. [**This post**](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) has some good examples. – Alex Howansky Oct 26 '17 at 17:13
  • **Never** store plain text passwords. Instead use [`password_hash()`](http://us3.php.net/manual/en/function.password-hash.php) and [`password_verify()`](http://us3.php.net/manual/en/function.password-verify.php). If you're using a version of PHP prior to 5.5, do **not** use MD5 or SHA1 to hash passwords. Instead you can use [this compatibility pack](https://github.com/ircmaxell/password_compat). – Alex Howansky Oct 26 '17 at 17:13

1 Answers1

2

You are not using the mysqli feature correctly. The fact that mysqli_query returns true does not mean that your query returned any rows. You need to use the mysqli_num_rows method. Something like this should do it:

if (mysqli_num_rows($r_user) > 0) {
  echo "That username is already taken<br>";
}

I would also recommend that you use the object oriented style rather than the procedural.

4thex
  • 1,094
  • 1
  • 9
  • 21