I tried to make a login API for something but I got a MySQL error And I do not know how to fix it. This is the error
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '''' at line 1
Can someone help me out? Also if you have a better suggestion or script / framework / etc to build this API link me it cause I need a API for user managemant with own fields.
This is my code:
<?php
include ('config.php');
$con = mysqli_connect(HOST, USER, PASS, NAME) or die("Error " . mysqli_error($link));
if(!isset($_GET["id"]))
{
/*
@ Login or Register
@ api.php?set=[Login/Register]&...
*/
if(isset($_GET["set"]))
{
$set = $_GET["set"];
if($set == "register")
{
if(isset($_GET["username"]))
{
if(isset($_GET["password"]))
{
if(isset($_GET["email"]))
{
$username = mysqli_escape_string($con, $_GET["username"]);
$password = mysqli_escape_string($con, $_GET["password"]);
$email = mysqli_escape_string($con, $_GET["email"]);
$query_cmd = mysqli_query($con, "SELECT * FROM users WHERE username='$username'");
$query_exe = mysqli_fetch_array($query_cmd);
$rows = mysqli_num_rows($query_cmd);
if(!$rowcount == 1)
{
$query_cmd = mysqli_query($con, "SELECT * FROM users WHERE email='$email'");
$query_exe = mysqli_fetch_array($query_cmd);
$rows = mysqli_num_rows($query_cmd);
if(!$rowcount == 1)
{
$query_cmd = mysqli_query($con, "INSERT INTO users (id, username, password, email, ip, hwid, funds) VALUES ('" . $username . "','" . $password . "','" . $email . "','" . $_SERVER['REMOTE_ADDR'] . "'),'" . $_GET["hwid"] . "';");
if ($query_cmd == false)
{
echo "Register failed: " . mysqli_error($con);
}
else
{
echo "Registerd!";
}
} else {
echo "Email already in use";
}
} else {
echo "Username already in use";
}
}
}
}
} else if($set == "login")
{
if(isset($_GET["username"]))
{
if(isset($_GET["password"]))
{
$username = mysqli_escape_string($con, $_GET["username"]);
$password = mysqli_escape_string($con, $_GET["password"]);
$query_cmd = mysqli_query($con, "SELECT * FROM users WHERE username=$username");
$query_exe = mysqli_fetch_array($query_cmd);
$rows = mysqli_num_rows($query_cmd);
if($rowcount == 1)
{
if($password != $query['password'])
{
echo'Wrong password';
} else {
echo 'Successful login';
}
} else {
echo "Account does not exists";
}
}
}
} else {
echo "This is not a valid account option";
}
} else {
echo "This is not a valid API option";
}
} else {
// Gather information
}
mysqli_close($con);
?>