I keep getting this: Integrity constraint violation while trying to verify if email exists in database

Question

I'm creating a user management system. I can edit users. I can create users. I can verify that the email is in the correct format. However, my issue is with verifying if the same email exists in the database. I keep getting this error: Ouch, failed to run query: SQLSTATE[23000]: Integrity constraint violation: 1062 Duplicata du champ 'Markr@fun.com' pour la clef 'email'. This code is below. The first being the form that's used store info to the database. The second being the script that's run once the submit button is pressed.

<?php

require("../scripts/connect.php");


if(empty($_SESSION['user']))
{

    header("Location: ../hound/login.php");


    die("Redirecting to ../hound/login.php");
}

$query_parm = array(

':id' => $_GET['id']

 );


 $query = "

SELECT
*
FROM users 
WHERE 
id = :id
";


try
{
 $stmt = $db->prepare($query);
 $stmt->execute($query_parm);

}
catch (PDOException $ex)
{

die("Failed to run query: " . $ex->getMessage());

}

  $rows = $stmt->fetchAll();


  ?>


  <form action="../scripts/edit_users.php" method="post">

<?php foreach($rows as $row): ?>

Username:<br />
<b><?php echo htmlentities($row['username'], ENT_QUOTES, 'UTF-8'); ?></b>
<br /><br />
<input type="hidden" name="id" value="<?php htmlentities($row['id'],  ENT_QUOTES, 'UTF-8'); ?>">
First Name:<br />
<input type="text" name="first_name" value="<?php echo `enter code he  htmlentities($row['first_name'], ENT_QUOTES, 'UTF-8'); ?>" />
<br /><br />
Last Name:<br />
<input type="text" name="last_name" value="<?php echo htmlentities ($row['last_name'], ENT_QUOTES, 'UTF-8'); ?>" /> 
<br /><br />
E-Mail Address:<br />
<input type="text" name="email" value="<?php echo htmlentities($row     ['email'],ENT_QUOTES,'UTF-8'); ?>" /> 
<br /><br />
Password:<br />
<input type="password" name="password" value="" /><br />
<br /><br />
<input type="submit" value="Update User" />
<a href="../scripts/users.php">Back</a><br />
 <?php endforeach; ?>
 </form>

This is the script that's run when submit is pressed.

<?php


require("common.php");

if(empty($_SESSION['user']))
{

    header("Location: ../hound/login.php");


    die("Redirecting to ../hound/login.php");
}

if(!empty($_POST))
{

if (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL))
{

    die("Please enter a valid email address...");
}

if($_POST['email'] !=$_POST['email'])
{

    $query_email = "
         SELECT email
         from users
         where
         email = :email
    ";

    $query_goes = array(

    ':email' => $_POST['email']

    );
    try
    {

        $stmt = $db->prepare($query_email);
        $result = $stmt->execute($query_goes);
    }
    catch (PDOException $ex)
    {
        die("Failed to run query: " . $ex->getMessage());
    }
    $row = $stmt->fetch();
    if($row) 
    {
        die("That email is already in use...");
    }

}
}


  $array_value = array(
        ':email' => $_POST['email'],
        ':first_name' => $_POST['first_name'],
        ':last_name' => $_POST['last_name'],
        ':id' => $_POST['id']
   );



    $query = "UPDATE users 
        SET 
        email = :email,
        first_name = :first_name, 
        last_name = :last_name

        WHERE
          id = :id
        ";


       try
    {

        $stmt = $db->prepare($query);
        $result = $stmt->execute($array_value);
    }
    catch(PDOException $ex)
    {

        die("Ouch, failed to run query: " . $ex->getMessage());
    }



    header("Location: users.php");


    die("Redirecting to users.php");

   ?>

Answer 1

Exactly what are you trying to do here?

if($_POST['email'] !=$_POST['email'])

That's an impossible condition. "If this thing is not itself".

So your check to see if an email address exists NEVER gets executed, then you blindly try to insert it anyways.

As well, this is NOT how you do this sort of check. Even if the code was properly structured, there's NO guarantee that some parallel script won't be able to insert that very same email address in the (short) interval between this script doing its select and then the insert .

You should do an unconditional insert, and check if it succeeded, eg

if ($_POST) {
    $sql = "INSERT ..."
    try {
       ...execute...
    catch (PDOException $e) {
       if ($e->getCode() == 1062) // duplicate key violation
          ... email is a dupe
       }
    }
}

Answer 2

这可能是由于if($_POST['email'] !=$_POST['email'])行，因为该行始终评估为False因此它甚至不会检查数据库中是否已存在该电子邮件。