检查用户名是否可用以及电子邮件验证

Question

I have a problem with checking if the username exist. It works if it does exist. But if the username doesn't exist it just send me to an empy page. It seems that it doesn't go to the next statement.

Here the code

<?php
if($_POST[username]  && $_POST[email] &&  isset($_POST[password])  && isset($_POST[password2])  && $_POST[password] == $_POST[password2])
{
    include ('*********'); /my connection to the database
    $username = $_POST[username];

            //check with the registred members
    $query2 = "SELECT * FROM registredMembers WHERE username='$username'"; 
    $result2 = mysql_query($query2, $conn) or die(mysql_error());
    $existing_users = mysql_num_rows($result2) or die(mysql_error());

            // check with the temporarly members, waiting to activate account
    $query3 = "SELECT * FROM tempMembers WHERE username='$username'"; 
    $result3 = mysql_query($query3, $conn) or die(mysql_error());
    $existing_users2 = mysql_num_rows($result3) or die(mysql_error());

    if($existing_users != 0 && $existing_users2 != 0) 
    {
        echo "<div id='msg'>Användarnamnet är upptaget</div>";
    }

    else 
    {   
        $confirmCode = md5(uniqid(rand()));
        $query = "INSERT INTO tempMembers VALUES ('$confirmCode', '$_POST[username]', '$_POST[email]', '$_POST[password]')";
        $result = mysql_query($query, $conn) or die(mysql_error());

        if($result)
        {
            $to = $_POST[email];
            $subject = utf8_decode("Här är din bekräftelselänk");
            $header = utf8_decode("Från Adib Haider (PHP-Projekt)");
            $message = "Din bekräftelselänk \r\n";
            $message.= "Klicka på länken för att aktivera ditt konto \r\n";
            $message.= "http://labb.vgy.se/~adibbinhar/blogg/confirmation.php?passkey=$confirmCode";
            $sentmail = mail($to, $subject, utf8_decode($message), $header);

            if($sentmail)
                echo "<div id='msg'>Aktiveringsmailet har skickat till din e-postadress</div>";
            else 
                echo "<div id='msg'>Aktiveringsmailet skickades inte</div>";
        }

        else
            echo "<div id='msg'>Testa igen</div>";
    }   
}

else
    echo "<div id='msg'>Prova igen</div>";

the text is on swedish hope you can live with that :P

Answer 1

Add the "activated" column to your mysql:

MYSQL

ID | USERNAME | [...] FIELDS [...] | ACTIVATED
1  | Foo      | [...] FIELDS [...] | 1

PHP

[...]
$query2 = 'SELECT * FROM registredMembers WHERE username='. mysql_real_escape_string($username);
$result = mysql_query($query, $conn) or die(mysql_error());

while ($row = mysql_fetch_array($result)) {
    if($row['activated'] == 1) {
       // User activated
    } else {
       // Send activation email
    }
}

Not tested, but can do the job.

Answer 2

I'd check that tempMembers actually exists, and that you don't have any unique constraints in the database that prevent the insert from succeeding when you try with a username or email that already exists in the database.

if the INSERT mysql_query returns 0 as a result, you die with mysql_error(), you can't even get to the else clause since $result just can't be 0.

(and yes, I hope you sanitized your inputs before entering this function :-)

Answer 3

The problem here lies in your if statement.

if($existing_users != 0 && $existing_users2 != 0)

Should be

if($existing_users != 0 || $existing_users2 != 0)

I don't know how your system works, but I guess that a username that exists in the tempMembers table doesn't necessarily exist in the registredMembers table.

You want the if statement to say: If the user exists in either the tempMembers table or registeredMembers table.

Edit :

I guess the empty page you get is a page that will display errors if you active them.

Try adding this at the top of your php script:

error_reporting(E_ALL);
ini_set('display_errors', 1);

Answer 4

/I went through your code and added a little protection from injections as well as hopefully fixing your problem. Like Joachim said, when the mysql_num_rows didn't return anything, you die() the script.

This is the code I whipped together, you need to check the tables are correct and like, as this was a real quick run through:

    <?php
    if($_POST['username']  && $_POST['email'] &&  isset($_POST['password'])  && isset($_POST['password2'])  && $_POST['password'] == $_POST['password2'])
    {
        include ('*********'); //my connection to the database
        $username = mysql_real_escape_string($_POST['username']);
        $email = mysql_real_escape_string($_POST['email']);
        $password = mysql_real_escape_string($_POST['password']);

        //check with the registred members
        $query1 = "SELECT * 
                     FROM registredMembers as users, 
                          tempMembers as temp
                     WHERE users.username = '$username' 
                        OR temp.username ='$username'";

        $check = mysql_query($query1, $conn) or die(mysql_error());

        if(mysql_num_rows($check) < 1)
        {
            $confirmCode = md5(uniqid(rand()));
            $query = "INSERT INTO tempMembers (`confirmCode`, `username`, `email`, `password`) VALUES ('$confirmCode', '$username', '$email', '$password')";
            $result = mysql_query($query, $conn) or die(mysql_error());

            if($result)
            {
                $to = $email;
                $subject = utf8_decode("Här är din bekräftelselänk");
                $header = utf8_decode("Från Adib Haider (PHP-Projekt)");
                $message = "Din bekräftelselänk \r\n";
                $message.= "Klicka på länken för att aktivera ditt konto \r\n";
                $message.= "http://labb.vgy.se/~adibbinhar/blogg/confirmation.php?passkey=$confirmCode";
                $sentmail = mail($to, $subject, utf8_decode($message), $header);

                if($sentmail)
                {
                    echo "<div id='msg'>Aktiveringsmailet har skickat till din e-postadress</div>";
                }
                else
                { 
                    echo "<div id='msg'>Aktiveringsmailet skickades inte</div>";
                }
            }

            else
            {
                echo "<div id='msg'>Testa igen</div>";
            }
        }

        else
        {
            echo "<div id='msg'>Användarnamnet är upptaget</div>";
        }   
    }
    else
    {
        echo "<div id='msg'>Prova igen</div>";
    }