9

I've looked at the many other posts that were similar to my issue and implemented their solutions (as far as I can tell) as exactly as I could. However, every time I execute this script, the code in the else block is executed (even when the username inputted is one that is already present).

The table name is 'Users' and the column that I am trying to search is 'username'. The input from my form was read into $username and I verified that it was read in properly using echo. $con contains the connection to the server.

At some point I also put in echo $query (nothing was printed) and echo mysql_num_rows($query) (nothing was printed).

Here's the relevant segment of the code. Would really appreciate some tips.

$query = mysql_query("SELECT username FROM Users WHERE username=$username", $con);

  if (mysql_num_rows($query) != 0)
  {
      echo "Username already exists";
  }

  else
  {
    ...
  }

EDIT: Apparently I was supposed to be using mysqli for my server and the way I checked the num_rows for that was by doing $query->num_rows since it was a property of the object. Thanks for all the help!

7
  • what's the version of your PHP? Nov 30, 2013 at 5:09
  • 1
    and add single quotes (') between $username Nov 30, 2013 at 5:15
  • 1
    Every time you use the mysql_ database extension in new code this happens it is deprecated and has been for years and is gone for ever in PHP7. If you are just learning PHP, spend your energies learning the PDO or mysqli database extensions and prepared statements. Start here
    – RiggsFolly
    Apr 20, 2018 at 16:54
  • Does this answer your question? How to check if a row exists in MySQL?
    – Dharman
    Nov 27, 2019 at 21:06
  • @Dharman The problem is the lack of single quotes around the username. I mean, one of the problems. Nov 27, 2019 at 21:55

8 Answers 8

9

change your query to like.

$username = mysql_real_escape_string($username); // escape string before passing it to query.
$query = mysql_query("SELECT username FROM Users WHERE username='".$username."'");

However, MySQL is deprecated. You should instead use MySQLi or PDO

8
  • I think it would return the same Nov 30, 2013 at 5:13
  • 3
    DO NOT USE THIS CODE. It is vulnerable to SQL Injection... Look up prepared statements.
    – Jack
    Dec 7, 2018 at 16:46
  • @JackNicholson MySQL is old and deperacted don't use MySQL my frind upgrade your self lol. Dec 7, 2018 at 17:19
  • @Renish Khunt Please re-read my answer. I was not searching for anything. I was linked this and asked if it was okay. Which it certainly is not. You should state obviously that mysql is deprecated and have the prepared statement answer as an alternative
    – Jack
    Dec 7, 2018 at 18:28
  • 2
    @Renish Khunt - If people who are new are finding this on Google (Which they are) and think it is okay to use then there is clearly a problem. Your answer is no longer satisfactory in today's standards. I just suggest you update your answer so people are not misguided. I think you took it as a personal insult when I am just trying to let new developers aware that it is not okay to use anymore.
    – Jack
    Dec 7, 2018 at 18:32
6

$query = mysql_query("SELECT username FROM Users WHERE username='$username' ")

Use prepared statements, do not use mysql as it is deprecated.

// check if name is taken already
$stmt = $link->prepare("SELECT username FROM users WHERE username = :username");
$stmt->execute([
    'username' => $username
]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

if (isset($user) && !empty($user)){
    // Username already taken
}
2

Try this:

$query = mysql_query("SELECT username FROM Users WHERE username='$username' ")

Don't add $con to mysql_query() function.

Disclaimer: using the username variable in the string passed to mysql_query, as shown above, is a trivial SQL injection attack vector in so far the username depends on parameters of the Web request (query string, headers, request body, etc), or otherwise parameters a malicious entity may control.

0
-1

PHP 7 improved query.........

$sql = mysqli_query($conn, "SELECT * from users WHERE user_uid = '$uid'"); if (mysqli_num_rows($sql) > 0) { echo 'Username taken.'; }

-2

TRY THIS ONE

 mysql_connect('localhost','dbuser','dbpass');

$query = "SELECT username FROM Users WHERE username='".$username."'";
mysql_select_db('dbname');

    $result=mysql_query($query);

   if (mysql_num_rows($query) != 0)
   {
     echo "Username already exists";
    }

    else
   {
     ...
    }
-2

Everything is fine, just one mistake is there. Change this:

$query = mysql_query("SELECT username FROM Users WHERE username=$username", $con);
$query = mysql_query("SELECT Count(*) FROM Users WHERE username=$username, $con");

if (mysql_num_rows($query) != 0)
{
    echo "Username already exists";
}
else
{
  ...
}

SELECT * will not work, use with SELECT COUNT(*).

-2
$firstname = $_POST["firstname"];
$lastname = $_POST["lastname"];
$email = $_POST["email"];
$pass = $_POST["password"];

$check_email = mysqli_query($conn, "SELECT Email FROM crud where Email = '$email' ");
if(mysqli_num_rows($check_email) > 0){
    echo('Email Already exists');
}
else{
    if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $result = mysqli_query($conn, "INSERT INTO crud (Firstname, Lastname, Email, Password) VALUES ('$firstname', '$lastname', '$email', '$pass')");
}
    echo('Record Entered Successfully');
}
-2

Here's one that i wrote:

$error = false;
$sql= "SELECT username FROM users WHERE username = '$username'";
$checkSQL = mysqli_query($db, $checkSQL);

if(mysqli_num_rows($checkSQL) != 0) {
   $error = true;
   echo '<span class="error">Username taken.</span>';
}

Works like a charm!

1
  • provide an explanation regrading the changes that were made in order to get the desired result Sep 12, 2017 at 4:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.