Why is this code to check duplicate usernames not executing properly? - php

Question

$conn properly connects to the database.
The users table of the database consists of the following fields id,name, email, username and password. One of the entries in the table contains benedict as the value for the username.
Code:
$userslist = $conn->prepare("SELECT * FROM users WHERE username=?");
$userslist->bind_param("s",$user);
$usersresult=$userslist->execute();
if($userslist->num_rows>0)
{
$userErr="Username already exists";
$errors++;
}
Problem:
When I enter a username(which is being stored in $user) with benedict as the value, the code does not detect duplicate id in spite of already having such a username. Further, $userslist->num_rows when printed shows 0.
On the contrary the following code correctly identifies, that a duplicate id already exists and prints the errror. (this proves there is no connection error or table errors)
$query="SELECT * FROM users WHERE username='".$user."'";
$qresult=mysqli_query($conn,$query);
if($qresult->num_rows>0)
{ $userErr="Username already exists";
$errors++;
}
I am aware that unique key and PDO is a better solution. But why it doesn't prints proper results while using prepared statements.

Answer 1

An affected rows result of: -1 indicates the query returned an error and therefore wasnt executed.
Check your query for errors in column/tables names etc.
Is your connection working?
Please try the following to debug:
$userslist = $conn->prepare("SELECT * FROM users WHERE username=?");
$userslist->bind_param("s",$user);
$usersresult=$userslist->execute();
print_r($conn->error);

Answer 2

Id suggest using PDO to start with, it is much safer for DB queries. http://php.net/manual/en/book.pdo.php . I would also suggest that you use a count for this and not a SELECT *. This is a wasteful check to see if a row exists, it will be more efficient by using a count.
You would do this using PDO like this.
$stmt = $db->prepare("SELECT count(1) FROM users WHERE username=?");
$stmt->execute(array($user));
$result = $stmt->fetch();
if($result)
{
if($result[0] == 1) echo "Username already taken";
else "username free";
}
else
{
echo "error";
}

Answer 3

You could do something like this.
if(mysqli_num_rows($userslist) > 0){
echo "username already exists"
}
check if row exists with mysql - similiar question

Answer 4

Have you tried:
$conn = new mysqli("localhost","user","password","db");
$sql = "SELECT * FROM users where username='".$_POST['username']."'";
$result = $conn->query($sql);
$count = $result->num_rows;
if($count > 0)
{
echo "Username ".$_POST['username']." already exists!";
}

Answer 5

So error is not affected row: check why the query failed:
`
<?php
$userslist = $conn->prepare("SELECT * FROM users WHERE username=?");
$userslist->bind_param("s",$user);
$usersresult=$userslist->execute();
if($userslist->num_rows>0)
{
$userErr="Username already exists";
$errors++;
}
elseif($userlist->affected_rows == -1) {
echo 'An error occurred: ' . $conn->error;
}
?>
`
but you do realise, in the few milliseconds between the check and an actual insert, there might be an other user inserting that exact same name?
Added: how to do it when username is unique indexed:
<?php
$userslist = $conn->prepare("INSERT INTO users (username, name, etc) VALUES (?,?, ?)");
$userslist->bind_param("sss",$user, $name, $etc);
$usersresult=$userslist->execute();
if($conn->errno == 1062) {
$userErr="Username already exists";
$errors++;
}
elseif($conn->errno) {
echo 'An error occurred: ' . $conn->error;
}
else {
if($userlist->affected_rows == 1) {
echo 'success';
}
else {
echo 'unknown why not inserted';
}
}
?>