Login Registration Form Issue

Question

I am making a login/registration form for my site. When I am registering as a new user with a new username though it reads as if that username already exists even though the database is empty. I'll try to walk you through the code on this but I am not sure where the issue is.

the register.php I have it where it checks the user input if it matches anything in the database it will output the proper error message and if there is no matches it will then go to the register function to register the user into the database. Thank you :)

    if (isset($_POST['submit'])) {

    if(empty($_POST['username']) || empty($_POST['password']) || empty($_POST['email']) || empty($_POST['Fname'])){

        $errors[] = 'All fields are required.';

    }else{

        if ($users->user_exists($_POST['username']) === true) {
            $errors[] = 'That username already exists';
        }
        if(!ctype_alnum($_POST['username'])){
            $errors[] = 'Please enter a username with only alphabets and numbers';  
        }
        if (strlen($_POST['password']) <6){
            $errors[] = 'Your password must be atleast 6 characters';
        } else if (strlen($_POST['password']) >18){
            $errors[] = 'Your password cannot be more than 18 characters long';
        }
        if (filter_var($_POST['email'], FILTER_VALIDATE_EMAIL) === false) {
            $errors[] = 'Please enter a valid email address';
        }else if ($users->email_exists($_POST['email']) === true) {
            $errors[] = 'That email already exists.';
        }
    }

    if(empty($errors) === true){

        $username       = htmlentities($_POST['username']);
        $password       = $_POST['password'];
        $email          = htmlentities($_POST['email']);
        $firstName      = htmlentities($_POST['Fname']);
        $lastName       = htmlentities($_POST['Lname']);
        $accountType    = $_POST['account_type'];

        $users->register($username, $password, $email, $firstName, $lastName, $accountType);
        header('Location: register.php?success');
        exit();
    }
}

here is the functions Check to see if the the username and email already exists

public function user_exists($username) {

        $query = $this->mysqli->prepare("SELECT COUNT(`id`) FROM `users` WHERE `username`= ?");
        $query->bind_param('s', $username);

        $query->execute();
        $rows = $query->fetch();

        if($rows == 1){
            return true;
        }else{
            return false;
        }

    }

public function email_exists($email) {

    $query = $this->mysqli->prepare("SELECT COUNT(`id`) FROM `users` WHERE `email`= ?");
    $query->bind_param('s', $email);

        $query->execute();

        $rows = $query->fetch();

        if($rows == 1){
            return true;
        }else{
            return false;
        }

}

and the register function

public function register($username, $password, $email, $firstName, $lastName, $accountType){

    global $bcrypt; // making the $bcrypt variable global so we can use here

    $time       = time();
    $ip         = $_SERVER['REMOTE_ADDR']; // getting the users IP address
    $email_code = $email_code = uniqid('code_',true); // Creating a unique string.

    $password   = $bcrypt->genHash($password);

    $query  = $this->mysqli->prepare("INSERT INTO `users` (`username`, `password`, `email`, `ip`, `time`, `email_code`, `firstName`, `lastName`, `accountType`) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?) ");

    $query->bind_param('ssssissss',$username, $password,  $email, $ip, $time, $email_code, $firstName, $lastName, $accountType);


    $query->execute();
            }

Answer 1

I believe your problem is this line in public function user_exists($username) -

$rows = $query->fetch();

$rows is not being set to the value from your query, but just returning true as the $query->fetch() succeeded. Reading from the manual for mysqli_stmt::fetch -

all columns must be bound by the application before calling mysqli_stmt_fetch().

Try changing it to -

public function user_exists($username) {

    $query = $this->mysqli->prepare("SELECT COUNT(`id`) FROM `users` WHERE `username`= ?");
    $query->bind_param('s', $username);

    $query->execute();

    // Bind the results       
    $query->bind_result($count);

    while($rows = $query->fetch()){

       if($count == 1){
          return true;
       }else{
          return false;
       }

    }

}

you would also need to do this for public function email_exists($email)