I have a bad issue on our website and require a solution.
So basically, in the code below, we take the user's email as set it as a username in the database and along with it a random password taken from the MOCK_DATA.csv file and stores it in the database.
But it performs a check, so if the username doesn't already exist in the database, then it inserts the username and password. If the username already exists, then just update the password.
Now here is the issue below:
Description of the issue:
After a user has made a purchase, if the username already exists in the database, the password for that user and all other users in the database are updated to that password.
To clarify, it doesn't happen if it's a new user. So if email abc@gmail.com is not in the database, abc@gmail.com and the password 123456 are inserted into the database and none of the other users in the database have their password affected.
However, if I make a purchase with the same email abc@gmail.com again, the password will be updated for that user (let's say 654321), but all other user's passwords in the database will be set to 654321 as well.
Expected result:
The password should only update for that one single user if the username already exists.
Actual Result:
The password updates for all users.
$email_address = $_GET['email'];
$email_address_metis = "xxx@xxx.com.test-google-a.com";
// Get the access code
$csv = array_map('str_getcsv', file('MOCK_DATA.csv'));
// Get random index from array $arrX
$randIndex = array_rand($csv[0]);
// Define variables and initialize with empty values
$username = $password = $confirm_password = "";
$username_err = $password_err = $confirm_password_err = "";
// Processing form data when form is submitted
//if($_SERVER["REQUEST_METHOD"] == "POST"){
// Prepare a select statement
$sql = "SELECT id FROM users WHERE username = ?";
if ($stmt = mysqli_prepare($link, $sql)) {
// Bind variables to the prepared statement as parameters
mysqli_stmt_bind_param($stmt, "s", $param_username);
// Set parameters
$param_username = $email_address; //trim($_POST["username"]);
// Attempt to execute the prepared statement
if (mysqli_stmt_execute($stmt)) {
/* store result */
mysqli_stmt_store_result($stmt);
if (mysqli_stmt_num_rows($stmt) == 1) {
$username_err = "exists";
}
} else {
$username = $email_address; //trim($_POST["username"]);
}
} else {
echo "Oops! Something went wrong. Please try again later.";
}
// Close statement
mysqli_stmt_close($stmt);
//}
// Output the value for the random index
// Validate password
$password = $csv[0][$randIndex];
if ($username_err !== "exists") {
// Prepare an insert statement
$sql = "INSERT INTO users (username, password) VALUES (?, ?)";
if ($stmt = mysqli_prepare($link, $sql)) {
// Set parameters
$param_password = password_hash($password, PASSWORD_DEFAULT); // Creates a password hash
// Bind variables to the prepared statement as parameters
mysqli_stmt_bind_param($stmt, "ss", $param_username, $param_password);
// Attempt to execute the prepared statement
if (mysqli_stmt_execute($stmt)) {
// Redirect to login page
// header("location: login.php");
} else {
// echo "Something went wrong. Please try again later.";
}
// Close statement
mysqli_stmt_close($stmt);
}
} else {
// Prepare an update statement
$sql = "UPDATE users SET password = ? WHERE username = ?";
if ($stmt = mysqli_prepare($link, $sql)) {
// Bind variables to the prepared statement as parameters
mysqli_stmt_bind_param($stmt, "si", $param_password, $param_username);
// Set parameters
$param_password = password_hash($password, PASSWORD_DEFAULT);
$param_username = $username;
// Attempt to execute the prepared statement
if (mysqli_stmt_execute($stmt)) {
// Password updated successfully. Destroy the session, and redirect to login page
session_destroy();
header("location: login.php");
exit();
} else {
echo "Oops! Something went wrong. Please try again later.";
}
// Close statement
mysqli_stmt_close($stmt);
}
}
// Close connection
mysqli_close($link);
si
< the "i" for the username in the UPDATE. That "i" should most likely be an "s" also. I doubt the username is an integer.