Generating JSON with PHP error - php

Question

I have the following script where the user enters some data from the android phone in order to register.
<?php
include("connect.php");
include("functions.php");
if(logged_in())
{
header("location:profile.php");
exit();
}
$error = "";
$j = new stdClass();
$string = "";
if (isset($_POST['firstName']) && isset($_POST['lastName']) && isset($_POST['email']) && isset($_POST['password'])) {
$firstName = $_POST['firstName'];
$lastName = $_POST['lastName'];
$email = $_POST['email'];
$password = $_POST['password'];
//echo $firstName."<br/>".$lastName."<br/>".$email."<br/>".$password."<br/>".$passwordConfirm."<br/>".$image."<br/>".$imageSize."<br/>";
//We need to encrypt our password.
$password = md5($password);
$insertQuery = "INSERT INTO users(firstName,lastName,email,password) VALUES('$firstName','$lastName','$email','$password')";
$result = mysqli_query($con,$insertQuery);
if(!$result){
$j->status = "Fail";
$j->message = "No users in database";
$string = json_encode($j);
echo "No inserted data";
//echo $string;
}else{
$j->status = "success";
$j->message = "Successfully registered";
echo "Data inserted";
$string = json_encode($j);
}
echo $string;
}
?>
Unfortunately nothing happens. I can't even generate JSON from the url itself. For example I enter the url's link
http://localhost/android_reg/
and get nothing back. Shouldn't I get
{
"status":"fail",
"status":"No users in database"
}
when there is not data in the database? Surely there is something wrong with my php code.

Answer 1

No. You shouldn't get anything thing back. The main part of your code checks various $_POST variables to see if they're set. Requesting the page in your web browser is a HTTP GET request, so you'll never see any output because the POST variables will never be set.

Answer 2

Make sure your script generates json-output in any case.
Since the fail-branch is usually shorter I prefer to handle it first. In your case: if there is any POST parameter missing -> bail out.
Your script is also prone to sql injections. Prepared statements can avoid that.
<?php
require 'connect.php';
require 'functions.php';
if(logged_in())
{
header("location:profile.php");
exit();
}
// isset() can take multiple arguments and only returns true if all variables are set
if ( !isset($_POST['firstName'], $_POST['lastName'], $_POST['email'], $_POST['password']) ) {
$result = array('status'=>'fail', 'message'=>'missing POST parameter(s)');
}
else {
$stmt = $con->prepare('
INSERT INTO
users
(firstName,lastName,email,password)
VALUES
(?,?,?,?)
');
if ( !$stmt ) {
$result = array('status'=>'fail', 'message'=>'prepare failed');
}
else if ( !$stmt->bind_param('ssss', $_POST['firstName'], $_POST['lastName'], $_POST['email'], $_POST['password']) ) {
$result = array('status'=>'fail', 'message'=>'bind failed');
}
else if ( !$stmt->execute() ) {
$result = array('status'=>'fail', 'message'=>'execute/insert failed');
}
else {
$result = array('status'=>'success', 'message'=>'Successfully registered');
}
}
// single, unconditional exit/output point (ok, except for the if(logged_in())/exit() thing)
echo json_encode($result);