-1

I have a bad issue on our website and require a solution.

So basically, in the code below, we take the user's email as set it as a username in the database and along with it a random password taken from the MOCK_DATA.csv file and stores it in the database.

But it performs a check, so if the username doesn't already exist in the database, then it inserts the username and password. If the username already exists, then just update the password.

Now here is the issue below:


Description of the issue:

After a user has made a purchase, if the username already exists in the database, the password for that user and all other users in the database are updated to that password.

To clarify, it doesn't happen if it's a new user. So if email abc@gmail.com is not in the database, abc@gmail.com and the password 123456 are inserted into the database and none of the other users in the database have their password affected.

However, if I make a purchase with the same email abc@gmail.com again, the password will be updated for that user (let's say 654321), but all other user's passwords in the database will be set to 654321 as well.

Expected result:

The password should only update for that one single user if the username already exists.

Actual Result:

The password updates for all users.

$email_address = $_GET['email'];
$email_address_metis = "xxx@xxx.com.test-google-a.com";

// Get the access code
$csv = array_map('str_getcsv', file('MOCK_DATA.csv'));
// Get random index from array $arrX
$randIndex = array_rand($csv[0]);

// Define variables and initialize with empty values
$username = $password = $confirm_password = "";
$username_err = $password_err = $confirm_password_err = "";

// Processing form data when form is submitted
//if($_SERVER["REQUEST_METHOD"] == "POST"){

// Prepare a select statement
$sql = "SELECT id FROM users WHERE username = ?";

if ($stmt = mysqli_prepare($link, $sql)) {
    // Bind variables to the prepared statement as parameters
    mysqli_stmt_bind_param($stmt, "s", $param_username);

    // Set parameters
    $param_username = $email_address; //trim($_POST["username"]);

    // Attempt to execute the prepared statement
    if (mysqli_stmt_execute($stmt)) {
        /* store result */
        mysqli_stmt_store_result($stmt);

        if (mysqli_stmt_num_rows($stmt) == 1) {
            $username_err = "exists";
        }
    } else {
        $username = $email_address; //trim($_POST["username"]);
    }
} else {
    echo "Oops! Something went wrong. Please try again later.";
}

// Close statement
mysqli_stmt_close($stmt);
//}
// Output the value for the random index

// Validate password

$password = $csv[0][$randIndex];

if ($username_err !== "exists") {
    // Prepare an insert statement
    $sql = "INSERT INTO users (username, password) VALUES (?, ?)";

    if ($stmt = mysqli_prepare($link, $sql)) {

        // Set parameters
        $param_password = password_hash($password, PASSWORD_DEFAULT); // Creates a password hash

        // Bind variables to the prepared statement as parameters
        mysqli_stmt_bind_param($stmt, "ss", $param_username, $param_password);

        // Attempt to execute the prepared statement
        if (mysqli_stmt_execute($stmt)) {
            // Redirect to login page
            // header("location: login.php");
        } else {
            // echo "Something went wrong. Please try again later.";
        }

        // Close statement
        mysqli_stmt_close($stmt);
    }
} else {
    // Prepare an update statement
    $sql = "UPDATE users SET password = ? WHERE username = ?";

    if ($stmt = mysqli_prepare($link, $sql)) {
        // Bind variables to the prepared statement as parameters
        mysqli_stmt_bind_param($stmt, "si", $param_password, $param_username);

        // Set parameters
        $param_password = password_hash($password, PASSWORD_DEFAULT);
        $param_username = $username;

        // Attempt to execute the prepared statement
        if (mysqli_stmt_execute($stmt)) {
            // Password updated successfully. Destroy the session, and redirect to login page
            session_destroy();
            header("location: login.php");
            exit();
        } else {
            echo "Oops! Something went wrong. Please try again later.";
        }

        // Close statement
        mysqli_stmt_close($stmt);
    }
}

// Close connection
mysqli_close($link);
7
  • 3
    You're using si < the "i" for the username in the UPDATE. That "i" should most likely be an "s" also. I doubt the username is an integer. Apr 18, 2020 at 15:16
  • @FunkFortyNiner I'll be honest, I'm not a php developer, I actually own the website and noticed the issue (I have background in testing to help investigate this). So to make sure I have it correct, are you saying in the update statement it should be: mysqli_stmt_bind_param($stmt, "ss", $param_password, $param_username); Apr 18, 2020 at 15:19
  • Oh, i means integer and s means string Apr 18, 2020 at 15:19
  • That is correct. ^ Apr 18, 2020 at 15:20
  • I'll give it a go. Will update you in 5-10 mins Apr 18, 2020 at 15:20

1 Answer 1

1

So after a long discussion in chat between the OP and I, have come to the conclusion that the $username variable wasn't being populated, which in turn made your query/UPDATE fail because of it, and silently I might add.

Plus, the i in the mysqli_stmt_bind_param() for the UPDATE query was also an issue from the beginning, since you were trying to store a string using an integer format.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.