PHP and MySQL validating problem - php

Question

I'm trying to check if a color is already entered into the database if it is the color should not be entered and stored into the database and the following error code <p>This color has already been entered!</p> should be displayed. But for some reason I cant get this to work, can someone please help me?
The color names are entered into $_POST['color'] which is an array entered by the user.
Here is the html code that collects the colors.
<input type="text" name="color[]" />
<input type="text" name="color[]" />
<input type="text" name="color[]" />
<input type="text" name="color[]" />
<input type="text" name="color[]" />
<input type="text" name="color[]" />
<input type="text" name="color[]" />
<input type="text" name="color[]" />
<input type="text" name="color[]" />
Here is the PHP & MySQL code.
for($i=0; $i < count($_POST['color']); $i++) {
$color = "'" . $_POST['color'][$i] . "'";
}
$mysqli = mysqli_connect("localhost", "root", "", "sitename");
$dbc = mysqli_query($mysqli,"SELECT *
FROM colors
WHERE color = '$color'
AND user = '$user_id' ");
if(mysqli_num_rows($dbc) == TRUE) {
echo '<p>This color has already been entered!</p>';
} else if(mysqli_num_rows($dbc) == 0) {
// enter the color into the database
}

Answer 1

To avoid unnecessary querys you should fetch all colors first and check against them:
$colors = array();
$mysqli = mysqli_connect("localhost", "root", "", "sitename");
if($result = mysqli_query($mysqli,"SELECT color FROM colors WHERE user = '$user_id' ") {
while($row = mysqli_fetch_array($result)) {
$colors[] = $row['color'];
}
mysqli_free_result($result);
}
foreach($_POST['color'] as $color) {
if(in_array($color, $colors) {
echo '<p>Color ' . $color . ' has already been entered!</p>';
}
else {
// enter the color into the database
}
}
Make sure to sanitize the user input!

Answer 2

You have more than one colors so you should use something like following.
$mysqli = mysqli_connect("localhost", "root", "", "sitename");
for($i=0; $i < count($_POST['color']); $i++) {
$color = "'" . $_POST['color'][$i] . "'";
$dbc = mysqli_query($mysqli,"SELECT *
FROM colors
WHERE color = '$color'
AND user = '$user_id' ");
if(mysqli_num_rows($dbc) == TRUE) {
echo '<p>'.$color.' color has already been entered!</p>';
} else if(mysqli_num_rows($dbc) == 0) {
// enter the color into the database
}
}

Answer 3

I'm guessing the issue you're runnig into is that the database connection is allready open when you try to enter the new values into the database.
The solution is to first fetch everything from the database store it in an array, then run your checks and add accordingly.

Answer 4

You should use the IN operator. For example,
$color = null;
for($i=0; $i < count($_POST['color']); $i++) {
if ($color == null)
$sep = '';
else
$sep = ',';
$color = $sep . "'" . $_POST['color'][$i] . "'";
}
$mysqli = mysqli_connect("localhost", "root", "", "sitename");
$dbc = mysqli_query($mysqli,"SELECT *
FROM colors
WHERE color IN ($color)
AND user = '$user_id' ");

Answer 5

It isn't an answer actually, but very important thing to learn:
I mean the simple thing: at first you have to deal with SQL only, no PHP or HTML. Create an SQL query to check for the colors, run it, test it, and once you statisfied - go for PHP. try to create the same query from a variable, and compare with example one. Once finished, you can go for HTML at last.
So, development process must be split into 3 stages:
SQL stage. Create a query. If you don't know what query you want, Ask here on SO somethink like "I have 3 color names and a table. how to check if any of these colors exists in the table already". Once done - check it out to ensure query runs ok and return desired results.
PHP stage. Once you have a query, echo it from your PHP script. And write a code below, code which produce this query from some variables. Print it out to compare, until you get both queries identical.
HTML stage. Make an HTML form which will send color names into PHP script which will create SQL query from them and finally run it.
Remember: to know which query you want to run is very-very important! Without this knowledge you cannot go any further
Every answer here lack to mention SQL query itself.