PHP Validation user exists using PDO - php

Question

I have this form and start by checking if the fields are empty and it works pretty well. My question here is: why do i get errors when I want to verify if user exists?
Here is my code:
<?php
require_once '../../includes/database.php';
require '../../includes/functions.php';
if($_SERVER['REQUEST_METHOD'] == 'POST') {
$username = $_POST['username'];
$password = $_POST['password'];
$repassword = $_POST['re-password'];
$conn = connect($config);
if(empty($username) || empty($password) || empty($repassword)) {
$status = 'Fields must not be empty';
}
$results = $conn->query("SELECT * FROM admin WHERE username = " . $username);
foreach($results as $result) {
print_r($result);
}
}
include 'staff_create.view.php';

Answer 1

You need to enclose username between ' because is a string.
But you should use the potential of prepared statements:
$stmt = $conn->prepare("SELECT * FROM admin WHERE username = ?");
$stmt->execute($username);
$stmt = $stmt->fetchAll(PDO::FETCH_CLASS);
Or
$stmt = $conn->prepare("SELECT * FROM admin WHERE username = :username");
$stmt->execute(array(":username" => $username));
$stmt = $stmt->fetchAll(PDO::FETCH_CLASS);
You will avoid SQL injection writing your querys this way

Answer 2

You also might to check to see if the username is set...
$username="";
if (isset($_POST['username'])) {
$username = $_POST['username'];
}

Answer 3

You are missing the else statement and maybe a hard error after the $status is set...
<?php
require_once '../../includes/database.php';
require '../../includes/functions.php';
if($_SERVER['REQUEST_METHOD'] == 'POST') {
$username = $_POST['username'];
$password = $_POST['password'];
$repassword = $_POST['re-password'];
$conn = connect($config);
if(empty($username) || empty($password) || empty($repassword)) {
$status = 'Fields must not be empty';
}
else {
$results = $conn->query("SELECT * FROM admin WHERE username = " . $username);
foreach($results as $result) {
print_r($result);
}
}
}
include 'staff_create.view.php';