PHP data retrieving problem in database

Question

Ok so the problem is... i m a newbie and i m trying to understand what is happening.Im sending through an html form this data(name,email) using POST in a database.I understand the logic behind it all but what basically happens is that everytime I enter a name,any name,it echoes the else statement:"there is already a user with that name". and it sends back the first name in the database.when there s nothing,it sends nothing. So here's the chunk:

 $query= "SELECT* from users where username='".$_POST['name']."'";
        $result = mysql_query($query);
        if (!$result){


        $query = "INSERT into users (username, email, password) values
        ('".$_POST["name"]."', '".$_POST["email"]."',  
        '".$passwords[0]."')";
        $result = mysql_query($query);

        if ($result){
            echo "It's entered!";
        } else {
            echo "There's been a problem: ".mysql_error();
        }
     } else {

         echo "There is already a user with that name: <br />";
        $sqlAll = "select * from users";
         $resultsAll = mysql_query($sqlAll);
         $row = mysql_fetch_array($resultsAll);
           while ($row) {

              echo $row["username"]." -- ".$row["email"]."<br />";

           $row = mysql_fetch_array($result);

Jesus christ ANOTHER SQL injection vulnerability. Where do they all come from...!?!?!?!?!?!?!?!?!?!?!?! — Lightness Races in Orbit
– Lightness Races in Orbit, Commented Apr 3, 2011 at 20:36
i followed that tutorial from the IBM website.it s a learning tutorial.man,i m just learning about injection.i wouldn t use that on a real site.I m learning! — seb
– seb, Commented Apr 3, 2011 at 20:52
@seb: Can you provide a link please? I will write to IBM and ask them to stop promoting this nonsense. — Lightness Races in Orbit
– Lightness Races in Orbit, Commented Apr 3, 2011 at 20:54
@seb: Online tutorials are usually rubbish. Get yourself a good book instead! (BTW, Stack Overflow is not a "board".) — Lightness Races in Orbit
– Lightness Races in Orbit, Commented Apr 3, 2011 at 21:20

Community · Accepted Answer · 2023-11-17 19:22:09Z

2

You may want to check mysql_num_rows() rather than checking for !$result, I think that if the query is sucsesfull you'll get a resource back, even though it contains zero rows.

You may also want to read up on: http://php.net/manual/en/security.database.sql-injection.php

edited Nov 17, 2023 at 19:22

CommunityBot

11 silver badge

answered Apr 3, 2011 at 20:30

preinheimer

3,71223 silver badges34 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Janaka R Rajapaksha Over a year ago

If $result == false then mysql will throw an error with mysql_num_rows() expected the parameter to be resource but boolean given.

Layke · Accepted Answer · 2011-04-03 20:30:47Z

2

ESCAPEEEEE

Firstly, you need to learn about escaping. Have you never heard of little Johnny DROP TABLES?

http://xkcd.com/327/

Serious business

The reason why it always returns, is because the response in $result is actually a resource data type. And that will always when cast as a boolean be true. (And since your query shouldn't fail).

You should fetch the result. For example. (This isn't the best way, but it is a way to do it).

mysql_fetch_row(result)

answered Apr 3, 2011 at 20:30

Layke

53.5k11 gold badges88 silver badges111 bronze badges

Comments

robertlbolton · Accepted Answer · 2011-04-03 20:30:42Z

1

Per the manual, mysql_query will return false when there is an error - "For SELECT, SHOW, DESCRIBE, EXPLAIN and other statements returning resultset, mysql_query() returns a resource on success, or FALSE on error."

answered Apr 3, 2011 at 20:30

robertlbolton

1685 bronze badges

Comments

heximal · Accepted Answer · 2011-04-03 20:30:49Z

1

see no violation in your code. first mysql_query executes with no error and always returns true. try to test returned rows count like this:

if (mysql_num_rows($result) == 0) {
//insert record
} else {
// show alreay exists
}

answered Apr 3, 2011 at 20:30

heximal

10.5k5 gold badges49 silver badges73 bronze badges

Comments

code_burgar · Accepted Answer · 2011-04-03 20:30:52Z

0

First of all, you are testing for:

if (!$result)

which will evaluate to true only if the query fails.

You should also sanitize all input before using it in SQL queries.

answered Apr 3, 2011 at 20:30

code_burgar

12.3k4 gold badges37 silver badges53 bronze badges

Collectives™ on Stack Overflow

PHP data retrieving problem in database

5 Answers 5

1 Comment

ESCAPEEEEE

Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

1 Comment

ESCAPEEEEE

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related