₦airaland Forum

Help sort out this code

if(isset($_POST) & !empty($_POST)){
$fname = mysqli_real_escape_string($con, $_POST['fname']);
$sname = mysqli_real_escape_string($con, $_POST['sname']);
$password = mysqli_real_escape_string($con, hash("sha256", ($_POST['password'])));
$email = mysqli_real_escape_string($con, $_POST['email']);

$check_user = "SELECT count(*) FROM table WHERE username='$fname'";
$check_user_result = mysqli_query($con, $check_user);


if($check_user_result > 0){
$notEmpty = "User exist, please try another username";
}else{

$data_insert = "INSERT INTO crud (first_name, last_name, password, email_id) VALUES('$fname', '$sname', '$password', '$email')";

$data_query = mysqli_query($con, $data_insert) or die(mysqli_error($con));

if($data_query){
$smsg = "Data successfully inserted";
}else{
$fmsg = "Data insertion not successful, try again";
}

}
}

?>

freelancenig:
Help sort out this code

Hello freelancenig.
You didn't tell what you have as the error message coupled with what you want to accomplish.

However:
$check_user should be $fname NOT '$fname'. The latter is a literal string rather than a variable which you intend for the spot.
In $data_insert, you did the same to the post variables. E.g. $fname NOT '$fname'. Do same correction for the other variables.

Don't hash the password in the password variable. Do that at the point of insertion onto the database.

//Check for existing username:

$query= "SELECT * FROM users WHERE username='$username'";
$data=mysqli_query($conn, $query);
//not found, then insert
if (mysqli_num_rows($data) == 0){
$query="INSERT into users (username, password) VALUES ('$username', SHA256('$password') )";
mysqli_query($conn, $query);
echo 'Success';
}else{
echo 'user exists!'
}

Just follow this sort of logic

Wrong.

Hash the password BEFORE the query in a variable such as

$password = hash ('sha256', $pass);

And you should use mysqli_num_rows ();

To check that it exists, it should be >0 not ==0
To check that it DOES NOT exists, it should be <1

Greene66:
Wrong.

Hash the password BEFORE the query in a variable such as

$password = hash ('sha256', $pass);

And you should use mysqli_num_rows ();

To check that it exists, it should be >0 not ==0
To check that it DOES NOT exists, it should be <1

Your coding logic is so wrong.
if $username shouldnt exist then mysqli_num_rows == 0 and not > 0