如果存在变量则更新否则回显错误消息？

Question

How can I make this script to where if it finds that the fname and lname do not exist that it will pop up a message saying that they never signed in.

<?php
session_start();
include_once("connect.php");
date_default_timezone_set("America/Winnipeg");
$date = ("m-d-Y");
$timeout = date("g:i:s a");
if ("SELECT EXISTS(
        SELECT *
        FROM signin_out
        WHERE   
            lname='" . $_POST['lastname'] . "'
            AND fname='" . $_POST['firstname'] . "'  
            AND date='" . $date . "')"
) {
    mysql_query("
        UPDATE signin_out
            SET timeout='" . $timeout . "' 
        WHERE
            lname='" . $_POST['lastname'] . "'
            AND fname='" . $_POST['firstname'] . "'
            AND timeout=''
    ");
    header("Location: ../index.html");
} else {
    echo "<script type='text/javascript>'";
    echo "alert('<p>Oops! You never signed in!</p><br><p>Please contact a
                    Librarian</p>');'";
    echo "</script>'";
    header('Location: ../index.php?notsignedin');
}
?>

This is an intranet site for a highschool.

Answer 1

$sql = "SELECT COUNT(*) signedin FROM signin_out
        WHERE lname = '" . mysql_real_escape_string($_POST['lastname']) . "'
        AND fname = '" . mysql_real_escape_string($_POST['lastname']) . "'
        AND date = '$date'";
$result mysql_query($sql) or die(myqsl_error());
$row = mysql_fetch_assoc($result);
if ($row['signedin'])) {
    // update table
} else {
    // Report not signed in
}

However, you really should switch to mysqli or PDO so you can use parametrized queries instead of concatenating strings, so you don't have to worry as much about escaping them.