PHP code inserting into Database without values in input fields

Question

Can someone please explain to me why the code that I have not commented out here is still inserting into my Data base, even when I leave the Sign Up forms input values blank?

Thanks!

PHP

<?php

        require_once("connection.php");

    if ($_POST['submit'] == "Sign Up") {

        if (!$_POST['email']) { $error.="<br />Please enter your email"; 

        } else if (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) { $error.="<br />Please enter a valid email address";

        } if (!$_POST['password']) { $error.="<br />Please enter your password";

        } else if (strlen($_POST['password']) <8) { $error.="<br />Please enter a password of at least 8 characters in length";

        } if (!preg_match('`[A-Z]`', $_POST['password'])) { $error.="<br />Please enter at least one Uppder Case charater";

        }

        if ($error) { echo "There were error(s) in your signup details:".$error;

        } else {

                $query = "SELECT * FROM `users` WHERE `email`='".mysqli_real_escape_string($link, $_POST['email'])."'";

                $result = mysqli_query($link, $query);

                $results = mysqli_num_rows($result);

        } if ($results) { echo "That email address is already in registered. Do you want to log in?"; 

        } else {

                $query = "INSERT INTO `users` (`email`, `password`) VALUES ('".mysqli_real_escape_string($link, $_POST['email'])."', '".md5(md5($_POST['email']).$_POST['password'])."')";

                mysqli_query($link, $query);

                echo "You&apos;ve been signed up!";

        }

    }

        //if ($_POST['submit'] == "Log In") {

                //$query = "SELECT * FROM `users` WHERE `email` = '".mysqli_real_escape_string($link, $_POST['loginemail'])."' AND `password` = '".md5(md5($_POST['loginemail']).$_POST['loginpassword'])."' LIMIT 1";

                //$result = mysqli_query($link, $query);

                //$row = mysqli_fetch_array($result);

        //} if ($row) {

                //$_SESSION['id']=$row['id'];

                //print_r($_SESSION);

        //} else {

                //echo "We could not find a user with that email and password. Please try again.";

    //}
?>

HTML

<form method="post">

    <input type="email" name="email" id="email" placeholder="Your Email" value="<?php echo addslashes($_POST['email']);?>" />

    <input type="password" name="password" id="password" placeholder="Your Password" value="<?php echo addslashes($_POST['email']);?>" />

    <input type="submit" name="submit" value="Sign Up" />

</form>


<form method="post">

    <input type="email" name="loginemail" id="loginemail" placeholder="Your Email" value="<?php echo addslashes($_POST['loginemail']);?>" />

    <input type="password" name="loginpassword" id="loginpassword" placeholder="Your Password" value="<?php echo addslashes($_POST['loginemail']);?>" />

    <input type="submit" name="submit" value="Log In" />

</form>

Thanks for the help on my post edit there Nishant.

Sean Ravenhill
– Sean Ravenhill

2015-04-17 11:09:23 +00:00
Commented Apr 17, 2015 at 11:09 — Sean Ravenhill
– Sean Ravenhill, Commented Apr 17, 2015 at 11:09

jeroen · Accepted Answer · 2015-04-17 11:13:54Z

3

Your logic is wrong:

if ($error) {
   echo "There were error(s) in your signup details:".$error;
} else {
   ...
   // here `$results` is set
}

// What happens if `$results` is not set?
if ($results) {
   echo "That email address is already in registered. Do you want to log in?"; 
} else {
   // Yep, we go here...
   // insert!

Note that if there is an error, $results will not be set so you will enter in the else part of your second if statement, inserting a faulty row.

You should put everything inside your error-free block or check again when you want to insert:

if ($results && !$error) {

Or set $results to false in your error block, etc.. Several solutions possible.

answered Apr 17, 2015 at 11:13

jeroen

91.8k22 gold badges117 silver badges132 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Sean Ravenhill Over a year ago

Hi Jerome. Thanks for your answer. I understand what you are saying, but as I am very very new to developing and PHP, I'm battling to put it into practise. If at all possible could you show me one of your solutions? Many Thanks.

jeroen Over a year ago

@SeanRavenhill I already did, just replace your if ($results) { with if ($results && !$error) {.

Sean Ravenhill Over a year ago

@ jeroen Thanks for the quick reply. I did replace as suggested. Refreshed the page and even restarted the MAMP servers. Still get the same problem though.

Marco Bernardini · Accepted Answer · 2015-04-17 11:11:53Z

0

Probably your DB table has an auto-increment field, so even if you insert empty values it will add a line.

answered Apr 17, 2015 at 11:11

Marco Bernardini

7057 silver badges17 bronze badges

3 Comments

Sean Ravenhill Over a year ago

Hi Marco, thanks for the answer. I have a four column DB Table. With name, email and password set as text. And then id as an INT, PRIMARY with auto-increment field. How would I be able to sign up users with an id, and work around this auto-increment issue?

Shashikumar Misal Over a year ago

They have to add a unique username Or anyway email will be there. & id is not used for login or signup.

Marco Bernardini Over a year ago

@SeanRavenhill as suggested by Misal, you have to check for empty values before the query. Autoincrement is the greatest thing since sliced bread, because it gives you an unique id without hassles.

Shashikumar Misal · Accepted Answer · 2015-04-17 11:13:39Z

0

Always use if(!isset($_POST['name'])) for validations otherwise the "empty" is also be a value for post. Try it out, hope this will help you.

answered Apr 17, 2015 at 11:13

Shashikumar Misal

5092 silver badges16 bronze badges

Collectives™ on Stack Overflow

PHP code inserting into Database without values in input fields

3 Answers 3

3 Comments

3 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related