-2

so i want to count the number of entries that match the given 'username' and depending on whether its 0 or 1 i want to return true or false. but i'm not sure how. i can't find a mysql_return equivalent in mysqli. the $username is a defined variable in another script file.

<?php 
function user_exists($username) {
    $query = mysqli_query($connect, "SELECT COUNT('userid') FROM 'users' WHERE 'username' = '$username' ");
    return (mysqli_result($query, 0) == 1) ? true : false ;
}
?>

this is where i'll be using the user_exists() function.

<?php
include 'core/init.php';

if (empty($_POST) === false) {
    $username = $_POST['username'];
    $password = $_POST['password'];

    if (empty($username) === true || empty($password) === true) {
        $errors[] = 'You need to enter a user name and password';
    }
    else if (user_exists($username) === false) {
        $errors[] = "Username not found.";
    }
}
?>

i can include the init.php file but it doesn't seem necessary. its just a file that includes and requires a bunch of other files. including the one that has the user_exists() function. This is my connection script also included in the init.php

<?php
$connect_error = "Connection Problem";
$connect = mysqli_connect('localhost', 'root', '', 'people') or die(connect_error);
?>
5
  • WHat is your connection variable??
    – Saty
    Commented Apr 20, 2016 at 8:23
  • i added it. its called $connect Commented Apr 20, 2016 at 8:26
  • I can't find a mysql_return equivalent in mysql...!? What's that supposed to be?
    – deceze
    Commented Apr 20, 2016 at 8:27
  • 1) You're not passing $connect to your mysqli_query, 2) you're open to MySQL injection.
    – deceze
    Commented Apr 20, 2016 at 8:29
  • You better try to check the number of rows of the query result, then you can return a boolean value depending on the number of rows
    – Borjante
    Commented Apr 20, 2016 at 8:50

1 Answer 1

1

You had a few mistakes in your query syntax so check this carefully.

To get a row count I believe SELECT EXISTS(SELECT 1 FROM...) is most efficient.

I have also passed the connection to this function, remember the mysqli_ proceedural functions all need the connection handle to work, thats one of the main issues with converting mysql_ to mysqli_

I have also prepared the statement and bound the param to mitigate against SQL Injection issues.

And added some error processing, which writes errors to the php error log.

<?php 
function user_exists($con, $username) {
    $cnt = 0;
    $sql = "SELECT EXISTS(SELECT 1 FROM `users` WHERE `username` = ?";
    $stmt = mysqli_prepare($con, $sql);

    if ( $stmt === false ) {
        error_log('user_exists() count failed: ' . mysqli_stmt_error($stmt), 0);
        exit;
    }

    mysqli_stmt_bind_param($stmt, 's', $username);
    $res = mysqli_stmt_execute($stmt);

    if ( $res === false ) {
        error_log('user_exists() count failed: ' . mysqli_stmt_error($stmt), 0);
        exit;
    }

    mysqli_stmt_bind_result($stmt, $cnt);
    return $cnt == 1;
}
?>

Now you will have to amend the call to

user_exists($connection, $username)

Not the answer you're looking for? Browse other questions tagged or ask your own question.