Check if a username already exists [duplicate] - php

Question

This question already has answers here:
How to check if a row exists in MySQL? (i.e. check if username or email exists in MySQL)
(4 answers)
Closed 6 years ago.
I want to check if a user already exists.
I made the following code but it is not working.
The echo in the checkUser is only to look if it jumps in the if clause.
$email = $_POST['email'];
$username = $_POST['username'];
$password = $_POST['password'];
$checkUserID = mysql_query("SELECT *
FROM users
WHERE username = '$username'");
if (mysql_num_rows($checkUserID) >= 1) {
//echo "User id exists already.";
echo "testststst";
$user1 = mysql_fetch_array($checkUserId);
$result = flashMessage("User is already taken, please try another one");
//print_r($user); // the data returned from the query
}else if(empty($form_errors)){
...formcheck...
}
I hope somebody can help me I don't know what to do.

Answer 1

I suggest you tu use PDO library. For your problem the best solution is to have the username in the table as PRIMATY KEY or with a UNIQUE CONSTRAINT. This way, if you try to insert two times the same username, the query will throw an exception (or will return false depending how you set it) and it's easier to do.

Answer 2

I can see the following problems with your code--
You haven't made any database connection.
You should check whether the $_POST variables are available or not. That is try to use if(isset) function to check it.
Try using prepared statements as they are more secure.

Answer 3

first of all ur code is vulnerable to sql injections. Wrapped the form data with the function.
<?php
//function to prevent sql injections
function validateFormData($formData) {
$formData = trim( stripslashes( htmlspecialchars( strip_tags( str_replace( array( '(', ')' ), '', $formData ) ), ENT_QUOTES ) ) );
return $formData;
}
$email = validateFormData($_POST['email']);
$username = validateFormData($_POST['username']);
$password = validateFormData($_POST['password']);
$checkUserID = mysql_query("SELECT *
FROM users
WHERE username = '$username'");
if (mysql_num_rows($checkUserID) >= 1) {
//echo "User id exists already.";
echo "testststst";
while ($row = mysqli_fetch_assoc($checkUserID)){
//set some variables to save some data
$usernameD = $row['username'];
}
//compare form username with db username{
if($usernameD === $username){
echo "Username already taken";
}else{
//continue the rest...
}
}
?>