Variable not working with SQL - php

Question

My issue I believe is fairly simple but after a whole day trying different variations I have resorted to bothering you guys, please excuse me if this has been covered but I could not find a close enough example
I have a php file that is a processing file for a simple html form
Process.php:
<?php
error_reporting(E_ALL); ini_set('display_errors', 1);
$host="1.2.3.4:3306"or die("wrong server"); // Host name
$username="username"or die("wrong Username"); // Mysql username
$password="password"or die("Wrong Password"); // Mysql password
$db_name="db-name"or die("wrong DB"); // Database name
$tbl_name="banned"or die("Wrong table"); // Table name
$member = isset($_REQUEST['member']) ? $_REQUEST['member'] : "";
// Connect to server and select database.
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");
$find_member = mysql_query("SELECT member FROM banned WHERE member='$member'")or
die(mysql_error());
$ban = mysql_fetch_array($find_member);
if($member == $ban['member']){
echo ("this member is banned");
}
else {
echo ("<form method='post' action='http://example.com/access.php'>
<input type='text' style='display:none;' value='<?php echo
htmlspecialchars($member);?'/>'
<button type='submit'>Continue</button>");
}
?>
Form.html:
<form method="post" action="http://example.com/process.php">
<input type="text" name="member">
<input type="submit">
</form>
What im trying to accomplish:
A user would type their member number in the form.html and click submit, process.php will catch POST and either echo the text "this member is banned" or if member number is not on banned sql table, then display a html button with with a hidden input field that will carry the $member variable on to the next page
What is actually happening
no matter what number is entered into the form.html it always displays the html button. there is one number on the blacklist but when entered still displays the button
Error reporting
php and sql error reporting displays no errors
Side note
DB structure
member VARCHAR(20) / id (auto increment) / Time (timestamp - defalt:current time stamp)
The member number is Alphanumeric and is max 15 characters
example: +ayw7394
The initial error of using:
if($member = $ban['member']){
was replaced with:
if($member == $ban['member']){
but produces the opposite effect of echoing the "banned member" message regardless of which number is being inputed
It seems as though the
if statements are being ignored
Can anyone please provide me with some advice?
thank you for your help so far

Answer 1

"no matter what number is entered into the form.html it always displays the html button. there is one number on the blacklist but when entered still displays the button"
The reason being is this:
In this if($member = $ban['member']) you're assigning = instead of comparing == to compare $member against the "member" row.
Change that to if($member == $ban['member'])
I must note that your present code is open to SQL injection. Use mysqli with prepared statements, or PDO with prepared statements, they're much safer.
Footnotes:
</input> isn't a valid closing tag and can be safely removed.
Edit:
Also this code block:
echo ("<form method='post' action='http://example.com/access.php'>
<input type='text' style='display:none;' value='<?php echo
htmlspecialchars($member);?'/>'
<button type='submit'>Continue</button>");
You're already in PHP, so there's no need for the <?php echo and ?>
Change it to:
echo ("<form method='post' action='http://example.com/access.php'>
<input type='text' value='".htmlspecialchars($member)."'/>
<button type='submit'>Continue</button>");
Which could explain why it shows "banned" because you're probably re-clicking on it after.
I suggest you just remove it and do a redirection instead.
Example, and by replacing it with the echo'd button:
else{
header("Location: your_form.html");
exit;
}

Answer 2

Your problem is at the line
if($member = $ban['member']){
This is actually always true because you are setting $member to be equal to $ban['member']. Did you mean ?
if($member == $ban['member']){

Answer 3

Echo $member and $ban['member'] to see if they are the same or different value.
Another step, other than guarding against SQL injection like someone else said, would be to run TRIM commands on your input and on your MYSQL fields to ensure spaces aren't an issue.