Else statement in PHP code not processing - php

Question

my IF statements in this code are working, but the ELSE statement NEVER processes...and I am not sure why....in fact all of the code processes up until the ELSE statement, and the captua works properly too, if the captcha is right, the user gets a positive message and the data is posted to the database. If the captcha is wrong, no information is posted, but no message is given either..please help:
if(isset($_POST["captcha"]))
if($_SESSION["captcha"] == strtolower($_POST["captcha"]))
if(mysql_query($sql)) {
echo "<script type='text/javascript'>alert('submitted successfully, The records manager will provide you with your record within 3 days!')</script>";
//mail('joe.blow#idaho.com', 'SRRS - New Records Await Processing', 'SRRS - There are new records for processing in the SRRS System' );
//$to = 'joe.blow2#idaho.com' . ', ';
//$to .= $email;
$to = "joe.blow3#idaho.com";
$subject = "SRRS NOTIFICATION - New Student Record Await Processing";
$message = "New Student Record Requests have been submitted and Await Processing";
$from = "joe.blow#idaho.com";
$headers = "From:" . $from;
mail($to,$subject,$message,$headers);
echo "<script type='text/javascript'>alert('An Email Has to sent from the SRRS Records Management System to the Records Management Administrator for Processing.')</script>";
//Mail the user
$to = $email;
$subject = "SRRS NOTIFICATION - Your new record request has been submitted.";
$message = "SRRS - Your new record request for $givenname, $legname has been submitted, It will be procssed within 3 working days";
$from = "joe.blow#idaho.com";
$headers = "From:" . $from;
mail($to,$subject,$message,$headers);
}
else
{
echo "<script type='text/javascript'>alert('Human Verification not entered properly!')</script>";
}

Answer 1

The problem is that your output for "human verification" being incorrect is the else statement for your SQL query rather than the if statement before that which does the captcha comparison.
Condensed version of what you're doing:
if(isset($_POST["captcha"]))
if($_SESSION["captcha"] == strtolower($_POST["captcha"]))
if(mysql_query($sql)) {
// do stuff
} else {
// output CAPTCHA ERROR! <-- wrong place
}
Change where your statement is:
if(isset($_POST["captcha"])) {
if($_SESSION["captcha"] == strtolower($_POST["captcha"])) {
if(mysql_query($sql)) {
// do stuff
} else {
// CAPTCHA was fine, but the SQL query failed.
}
} else {
echo "<script type='text/javascript'>alert('Human Verification not entered properly!')</script>";
}
}
Note: While using curly brackets for control structures are not necessary when you only have one statement following it (an if block counts as one statement), it's far better for readability if you include them (so I've added them for you).
Looking forward: there are better ways to write your code than lots of nested if statements. You should try working on a structure that catches and handles errors as they happen, instead of wrapping large blocks of code in if statements and dealing with the alternative at the end. Try something like this:
if(!isset($_POST['captcha']) || $_SESSION['captcha'] != strtolower($_POST['captcha'])) {
echo "<script type='text/javascript'>alert('Human Verification not entered properly!')</script>";
exit; // kill the rest of the execution
}
if(!mysql_query($sql)) {
// SQL query failed, output an error
exit; // kill the rest of the execution
}
// Everything's fine, do the rest of your stuff here.
This could be further optimised by using functions and returning false instead of exit from various levels of functions that you call whenever you find an error.
Lastly, I'd suggest that outputting Javascript like that with an alert is probably not the best way to be doing this. You should have a kind of structure where the script/function that performs the task returns a boolean result (true/false) representing whether everything has gone smoothly, perhaps with an accompanying error message to describe it, and you should have a separate script/function that deals with the presentation of that result. An simple example here would be setting the result and message to the session and redirecting the user with PHP to a page that presents the results, instead of using a script tag with an alert.
While I'm at it too - mysql_* functions are deprecated. You should use mysqli_* or PDO instead.