Ban System not working [closed] - php

Question

Closed. This question needs debugging details. It is not currently accepting answers.
Edit the question to include desired behavior, a specific problem or error, and the shortest code necessary to reproduce the problem. This will help others answer the question.
Closed 8 years ago.
Improve this question
I'm developing a banning sytem for my web site and all the values are correct and I get no errors on the page, but the data does not go into the table. Here's the code for database connectivity.
$host="localhost"; // Host name
$username="root"; // Mysql username
$password=""; // Mysql password
$db_name="PyroStudio"; // Database name
$tbl_name="banned"; // Table name
// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");
Here is the actual banning system itself
if ($_POST['post'])
{
//get data
$bannuser = $_POST['bannuser'];
$TypeBan = $_POST['TypeBan'];
$Reviewed = $_POST['Reviewed'];
$ModNote = $_POST['ModNote'];
$Reason = $_POST['Reason'];
$OffenItem = $_POST['OffenItem'];
$BanLengthMssg = $_POST['BanLengthMssg'];
$ReleaseMssg = $_POST['ReleaseMssg'];
$AppealMssg = $_POST['AppealMssg'];
//Connect To The Database
$connect = mysql_connect("localhost","root","");
mysql_select_db("PyroStudio");
$namecheck = mysql_query("SELECT bannuser FROM $tbl_name WHERE bannuser='$bannuser'");
$count = mysql_num_rows($namecheck);
if($count!=0)
{
die("This User Is Already Banned! <a href='home.php'>[Home]</a>");
}
//check for existance
if ($bannuser)
{
if(strlen($bannuser)>25||strlen($bannuser)<6)
{
echo "<b>Length Of Username Is Must Be Between 6 and 25 Characters Long!</b>";
}
else
{
$queryreg = mysql_query("
INSERT INTO $tbl_name VALUES ('$bannuser','$TypeBan','$Reviewed','$ModNote','$Reason','$OffenItem','$BanLengthMssg','$ReleaseMssg','$AppealMssg')
");
die ("<b>The Moderation Report Has Been Submitted! The User Is Now Banned!</b> <b><a href='home.php'>[Home]</a></b>");
}
}
}
?>
I've used this system before and now I dont know why it doesn't want to work. If you can help, that would be great.

Answer 1

mysql_query("SELECT bannuser FROM $tbl_name WHERE bannuser='$bannuser'");
Just don't. This is a giant gaping security hole. Also, your code may be failing because of unescaped $_POST data getting into SQL statement and breaking it. Or because you had missed something with INSERT query, since you hadn't even specified a column list. If you're interested in what is the issue, check MySQL server logs for those or the result of mysql_error() function.
Anyway, consider the following approach:
$db = new PDO("mysql:host=localhost;dbname=PyroStudio", "root", "");
$bannuser = $_POST["bannuser"];
if (strlen($bannuser) > 25 || strlen($bannuser) < 6) {
die("Invalid username.");
}
$count = $db->prepare("SELECT COUNT(*) FROM bannuser WHERE bannuser = ?")
->execute(array($bannuser))
->fetchColumn();
if ($count > 0) {
die("Already banned.");
}
$stmt = $db->prepare("INSERT INTO bannuser (bannuser, typeban, …) VALUES (:bannuser, :typeban, …)");
$stmt->bindParam("bannuser", $bannuser);
$stmt->bindParam("typeban", $_POST["typeban"]);
…
$stmt->execute();
This is not a complete code (in particular, I'm too lazy to type every inserted parameter out there) but just a rough sketch I've did from memory to get you started.