sql primary_key不起作用？

Question

i am currently working on a registration script for my website, and i noticed that when i register i can resubmit the form over and over and i have no idea why nothing stops me. i mean, here's the PHP script to use to see if a user already exsists:

function user_exists($username) {
$query = mysql_query("SELECT username FROM users WHERE username='$username'");
if (mysql_num_rows($query) != 0){
  return true;
 }
else{
return false;
}
}

and heres the SQL code i used to create the table:

CREATE TABLE IF NOT EXISTS `users` (
`user_id` int(11) NOT NULL AUTO_INCREMENT,
`username` varchar(32) CHARACTER SET utf8 COLLATE utf8_unicode_ci NOT NULL,
`password` varchar(128) CHARACTER SET utf8 COLLATE utf8_unicode_ci NOT NULL,
`email` varchar(1024) CHARACTER SET utf8 COLLATE utf8_unicode_ci NOT NULL,
`active` int(11) NOT NULL DEFAULT '0',
`ip` varchar(255) CHARACTER SET utf8 COLLATE utf8_unicode_ci NOT NULL DEFAULT '0.0.0.0',
`date` varchar(64) CHARACTER SET utf8 COLLATE utf8_unicode_ci NOT NULL,
PRIMARY KEY (`user_id`)
) ENGINE=InnoDB  DEFAULT CHARSET=utf8 AUTO_INCREMENT=61 ;

so if anyone could help me with this, any help will be appriciated.

Answer 1

this has nothing to do with answering your question, but everything to do with improving your ability to quickly write efficient & well written code:

your way:

function user_exists($username) {
$query = mysql_query("SELECT username FROM users WHERE username='$username'");
if (mysql_num_rows($query) != 0){
  return true;
 }
else{
return false;
}
}

better written way:

function user_exists($username) {
  $query = mysql_query("SELECT username FROM users WHERE username='$username'");
  if(mysql_num_rows($query) > 0) return true;
  return false;
}

sql statement seems fine, as long as you are calling your function and testing it properly it should work. although unless you are sanitizing your $username input before calling user_exists, you have a gaping security exploit right there ;)

Answer 2

I see a couple of problems in your code snippet.

1) The way that you are calling your user_exists() function, you are passing "true" as the username each time you call it. You have...

if (user_exists($_POST['username'] == true)) { 
    $errors[] = "Username already registered."; 
}

So the actual query you are running is...

SELECT username FROM users WHERE username='1';

Should be...

if (user_exists($_POST['username'])) { 
    $errors[] = "Username already registered."; 
}

2) You are missing a parameter when you call mysql_query(). There should be a second parameter with the connection.

$query = mysql_query($"SELECT userName FROM csg.user WHERE userName='$username'",$con);