Why isn't this PHP script actually adding rows to the database? - php

Question

<?php
session_start();
//Obtain data from register page
$email = $_POST['email'];
$password = $_POST['password'];
//Check to see user has input
if ($username !='' || $password !='' || $confirmpassword !='' || $email !='') {
if ($password1 == $password2) {
// connect to database
$db = new mysqli('removed', 'removed','removed' ,'removed');
// Check to see if connection was successful
if ($db->connect_errorno) {
die ('Sorry, we are having some issues with our database. We should be back online soon.');
}
// Prepare statement
$query = "INSERT INTO `database`.`users` (
`id` ,
`minecraftusername` ,
`email` ,
`password` ,
`joined` ,
`rank`
)
VALUES (
NULL , ?, ?, ?, NOW( ) , '1'
);";
$stmt=$db->prepare($query);
$stmt->bind_param('sss', $username, $email, $password);
//Execute query
$stmt->execute();
// header("Location: ../default.php");
echo 'You have successfully registered an account!';
} else {
// header("Location: ../default.php");
echo 'Passwords do not match.';
}
} else {
// header("Location: ../default.php");
echo 'Please fill out all the fields';
}
?>
When you try to register, it does echo the registered successfully message, but when I go to phpmyadmin the number of rows hasn't changed.
I am really not sure what errors I have made.
Any help would really be appreciated.

Answer 1

$password = $_POST['password'];
Here you set only $password, but then you expect other variables to exist,
if ($username !='' || $password !='' || $confirmpassword !='' || $email !='') {
if ($password1 == $password2) {
$confirmpassword and $password1 and $password2 are never set. Noted in comments by #RobP and #Ali.
You connect to the database only if $password1 == $password2, and you only die() in that block as well. So you might easily skip that whole block, and not die(), and go on to try to run the INSERT without having connected to the database. Noted in comment from #Erico.
if ($db->connect_errorno) {
It's connect_errno, not "connect_errorno". If that block of code were run, it would generate a notice: PHP Notice: Undefined property: mysqli::$connect_errorno. So this proves that your code to connect to the database was never run.
$stmt=$db->prepare($query);
$stmt->bind_param('sss', $username, $email, $password);
$stmt->execute();
You should always check the return value of prepare() and execute(). They return false if there is any problem with the statement. Like if you had a syntax error, or violated a unique constraint or something. Right now your INSERT might be failing but you'll never know. Also noted in a comment by #sanketh.
Or else you can set mysqli_report(MYSQLI_REPORT_STRICT) to raise exceptions if there's an error. Then you don't need to write code to check the return values, because your script will die if there's any mysqli error. You have to set this report mode before you connect to the database.
Also, you never set a value for $username.