How to create a SELECT statement that recognizes trim($_POST['First_Name']) - php

Question

// Create Your Variables
$First_Name = trim($_POST['First_Name']);
$Last_Name = trim($_POST['Last_Name']);
$Party_Size = trim($_POST['Party_Size']);
$Telephone = trim($_POST['Telephone']);
// Validate the Telephone Number before inserting into MySQL
if(!preg_match("/^[0-9]{3}-[0-9]{3}-[0-9]{4}$/", $Telephone)) {
echo "Please go back and enter a valid Telephone number using dashes.";
// Stop the Script if the Regular Expression does not match our sequence in the Database.
exit;
}
The problem is below. When I check if the user exists in the database the script works but if you add spaces it doesn't match the existing record in the database. Any suggestions?
$check = "SELECT * FROM Weddings WHERE First_Name = '$_POST[First_Name])' AND Last_Name = '$_POST[Last_Name])'";
$results = mysqli_query($mysqli, $check);
$data = mysqli_fetch_array($results, MYSQLI_ASSOC);
if ($data > 1) {
echo "You are already in our database. Someone will contact you soon.";
exit;
}

Answer 1

$firstname = mysqli_real_escape_string($mysqli, $_POST['First_Name']);
$lastname = mysqli_real_escape_string($mysqli, $_POST['Last_Name']);
$check = "SELECT * FROM Weddings WHERE First_Name LIKE '%{$firstname}%' AND Last_Name LIKE '%{$lastname}%'";
$results = mysqli_query($mysqli, $check);
$data = mysqli_fetch_array($results, MYSQLI_ASSOC);
if ($data > 1) {
echo "You are already in our database. Someone will contact you soon.";
exit;
}
As you can see, I added two extra lines that were suggested by geoffrey.
mysqli_real_escape_string - Escapes special characters in a string for use in an SQL statement, taking into account the current charset of the connection.
Whenever you are allowing your users to enter some data that will be used in a query, you always should escape that data before executing the query. Not every user is a friendly user. If a user has knowledge about SQL injection attack, he can easily type some parts of SQL that will enable him to do something that you don't want.
For example, let's say user entered John as the first name and Doe as the last name. When combined with the query, it looks like this SELECT * FROM Weddings WHERE First_Name LIKE 'John' AND Last_Name LIKE 'Doe'. Nothing wrong with it.
But, what if user enters 1' OR '1' = '1 as the first name and as the last name. Then when combined with the query it will look like this SELECT * FROM Weddings WHERE First_Name LIKE '1' OR '1' = '1' AND Last_Name LIKE '1' OR '1' = '1'. Once executed, it will return all rows in your table. Learn more about SQL injection.

Answer 2

Just realised the other answer posted here is incorrect, it performs a like query which is not the OP's intent. The below answer trims any leading or trailing whitespace from the posted values, escapes them for security, and then performs an exact match on them. By default MySQL performs case insensitive searches and as such the case of the name will not matter.
$firstname = mysqli_real_escape_string($mysqli, trim($_POST['First_Name']));
$lastname = mysqli_real_escape_string($mysqli, trim($_POST['Last_Name']));
$check = "SELECT * FROM Weddings WHERE First_Name = '$firstname' AND Last_Name = '$lastname'";
$results = mysqli_query($mysqli, $check);
if (mysqli_num_rows($results) > 0) {
echo "You are already in our database. Someone will contact you soon.";
exit;
}
Please note that using someone's full name to check for existence is not reliable, it is better to use something that is unique such as their email address.

Answer 3

There are two issues with the script. The posted data is tainted until you check that you're getting from the user what you expect. At this point, the user could enter a first name of "123". So, it should be checked for being alphabetical and the surname should be checked for being alphabetical and the possibility of an apostrophe or a hyphen, so a last name like "O'Reilly" as well as "Smith-Jones" is accepted, as follows:
<?php
$fname = $lname = "";
// check for tainted data
if (ctype_alpha($_POST['First_Name'])) {
$fname = trim($_POST['First_Name']);
}
if ( preg_match("/^[a-zA-Z'-]+$/, $_POST['Last_Name']) ) {
$lname = trim($_POST['Last_Name']);
}
Once, the data validates, then it is appropriate to pass data to trim() to remove superfluous space characters, such as a blank space, tab, newline, etc.
The second issue is making sure that the query is not vulnerable to SQL injection.
<?php
if (strlen($fname) > 0 && strlen($lname) > 0) {
$firstname = mysqli_real_escape_string($link, trim($fname));
$lastname = mysqli_real_escape_string($link, trim($fname));
$query = "SELECT * FROM Weddings WHERE First_Name = '$firstname' AND Last_Name = '$lastname'";
$results = mysqli_query($link, $query or die( mysqli_error($link) ) );
if (mysqli_num_rows( $results ) > 0) {
echo "You are already in our database. Someone will contact you soon.";
exit;
}
mysqli_close($link);
}
The problem tho' has not been adequately resolved as you can still get around mysqli_real_escape_string() if you're a hacker. Per the Manual:
The character set must be set either at the server level, or with the
API function mysqli_set_charset() for it to affect
mysqli_real_escape_string().
This article offers further insight. So, it is actually better to use prepared statements., as follows:
<?php
$dbh = new PDO("mysql:host=localhost;dbname=database", 'username', 'password');
$stmt = $dbh->prepare("SELECT * FROM Weddings WHERE First_Name = ? AND Last_Name = ?");
if ($stmt->execute( array( $fname,$lname))) {
$row = $stmt->fetch(PDO::FETCH_ASSOC));
if ($row !== FALSE){
echo "You are already in our database. Someone will contact you soon.";
}
}