1

I'm making a simple registration system in php however, even if i enter all correct details, it doesn't go to the database, it still echo that withError = 1 even if all entries are correct. Here is my php code.

<?php
if($submit)
{
    if ($fullname && $email && $username && $password && $conPassword)
    {
        if(preg_match("/^([a-zA-Z0-9])+([a-zA-Z0-9\._-])*@([a-zA-Z0-9_-])+([a-zA-Z0-9\._-]+)+$/", $email))
        {
            $query1 = "SELECT Email FROM tbl_userAccounts WHERE Email='$email'";
            $result1 = mysqli_query($mysqli,$query1) or die(mysqli_error());
            if (mysqli_num_rows($result1) < 0)
            echo "email is already used. ";
            $withError = true;
        }
        else
        {
            echo "invalid email address. ";
            $withError = true;
        }
        if (strlen($username) < $charMinimum)
        {
            echo "minimum of 6 characters for username. ";
            $withError = true;
        }
        else
        {
            $query2 = "SELECT Username FROM tbl_userAccounts WHERE Username='$username'";
            $result2 = mysqli_query($mysqli,$query2) or die(mysqli_error());
            if (mysqli_num_rows($result2) < 0)
            {
                echo "username is already used. ";
                $withError = true;
            }
        }
        if($password == $conPassword)
        {
            echo $withError;
            if($withError == false)
            {
                if (strlen($password) < $charMinimum)
                {
                    echo "minimum of 6 characters for password. ";
                    $withError = true;
                }
                else
                {
                    $query3 = "INSERT INTO tbl_userAccounts VALUES ('', '$fullname', '$username', '$password','$date', '$email')";
                    $result3 = mysqli_query($mysqli,$query3) or die(mysqli_error());
                    if($result3 && $withError == false)
                    echo "account has been successfully registered!";
                    else
                    echo "failed registration. ";
                }
            }
        }
        else
        {
            echo "passwords do not match. ";
            $withError = true;
        }
    }
}
else
{
    echo "fill out all fields. ";
    $withError = true;
}
?>
1
  • 2
    I get worried when I see PHP code not using PHP Prepared Statements to prevent SQL Injection vulnerabilities. I hope you are sanitizing your variables in code that hasn't been pasted here. If not, please consider re-writing the code to use PDO Prepared Statements rather than trying to sanitize your variables.
    – sarnold
    Dec 15, 2011 at 2:57

2 Answers 2

3

You forgot to wrap the nested IF statement.

    if(preg_match("/^([a-zA-Z0-9])+([a-zA-Z0-9\._-])*@([a-zA-Z0-9_-])+([a-zA-Z0-9\._-]+)+$/", $email))
    {
        $query1 = "SELECT Email FROM tbl_userAccounts WHERE Email='$email'";
        $result1 = mysqli_query($mysqli,$query1) or die(mysqli_error());
        if (mysqli_num_rows($result1) < 0) {
            echo "email is already used. ";
            $withError = true;
        }
    }
0
0
if (mysqli_num_rows($result1) < 0)
{
     echo "email is already used. ";
     $withError = true;
}

You forgot the curly bracket

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.