Value already exist in mysql database and php - php

Question

I have the code below to check on (a web registration form) whether the e-mail address is already exist in the db or not
It works good, it shows the e-mail already exist once i load the page. but it keeps process the form and input the same e-mail into the mysql database?
How can i stop the form from submitting if the e-mail address is already exist?
my code below:
$email = $_POST["email"];
$query = mysql_query("SELECT * FROM users WHERE email='$email'");
if(mysql_num_rows($query) != 0)
{
echo "email already exists";
}

Answer 1

A good idea is to run an AJAX check prior to posting the form, ie in the client form verification state. Hence the user will know before posting the form that email is already added...
An AJAX solution would be:
On the FORM page, having an jQuery function similar to this:
Add jQuery with the validator plugin:
<script type="text/javascript" src="/js/jquery.1.7.2.min.js"></script>
<script type="text/javascript" src="/js/jquery.validate.min.js"></script>
<script type="text/javascript">
jQuery.validator.addMethod("emailunique",function(value){
return eval($.ajax({
url: 'phptocheckunique.php',
data: "email="+value,
type: 'post',
async: false
}).responseText);
}, 'Email address already exists, must be unique!');
$(function() {
$('#yourform').validate();
});
</script>
Then in your form add the classes to the email input field:
<input type="text" name="email" value="" size="30" class="required email emailunique" />
Then make a separate PHP-script just for checking the DB (mail-address posted with $_POST['email'], similar to your above function (BUT SECURE!) that returns TRUE if there is an email already.
phptocheckunique.php:
<?php
$dbh = new PDO("mysql:host=$host;dbname=$dbname", $user, $pass);
$sth = $dbh->prepare("SELECT FROM users WHERE email = ?");
$sth->execute(mysql_real_escape_string($_POST['email']));
if ($sth->rowCount() > 0):
return true;
else:
return false;
endif;
But if you still use your method, add an ELSE statement in the last if routine, then you will only add the person if email is unique... Also your code is very unsecure, you should consider using PDO.

Answer 2

You probably don't want to stop the form being submitted as such, but rather have the form submitted, run the check (as your code does) and if there is a match, redirect the user back to the form page along with an error message telling them the email address already exists.
That way the form will be submitted - but not processed into the database until the email address is unique.
To borrow from your code:
$email = $_POST["email"];
$query = mysql_query("SELECT * FROM users WHERE email='$email'");
if(mysql_num_rows($query) != 0)
{
echo "email already exists";
// redirect back to form and populate with
// data that has already been entered by the user
}
else
{
// insert form contents into the database.
}
On that note, your code is rather vulnerable to injection attacks. You should switch to PDO or mysqli prepared statements when processing form data like this.

Answer 3

if(mysql_num_rows($query) != 0)
{
echo "email already exists";
}
else
{
mysql_query($ur_query);
}
Just put the "INSERT INTO ... " query for your database in the else part.

Answer 4

you need to give like this,
if(isset($_POST["email"])
{
$email = $_POST["email"];
$query = mysql_query("SELECT * FROM users WHERE email='$email'");
if(mysql_num_rows($query) != 0)
{
echo "email already exists";
}
}
it will executes after you submit the form.