MySQLi插入查询不从表单读取值，插入空白数据

Question

now the problem I am having is that the data submitted from the form is not being inserted into the database. My code is inserting a record into the users table, but only the static value "active" is being inserted. Nothing from the form fields is being included, and is blank.

connection.php is the initial database connection file, which is working as its inserting a row albeit blank (with exception of the acc_active set to active hardcoded). Search.php is not important

Here is my code.

<?php
        require "connection.php";
        require "search.php";
        $var_username = mysqli_real_escape_string($conn, $_POST['username']);
        $var_password = mysqli_real_escape_string($conn, $_POST['password']);
        $var_email = mysqli_real_escape_string($conn, $_POST['email']);

        if (isset($_GET['reg'])){
                if ($_GET['reg']=='1'){
                        $verify         =       mysqli_query("SELECT COUNT(*) AS NUM FROM users WHERE username = '$var_username'");
                        $result         =       mysqli_fetch_array($verify);
                        if($result[0]==1){
                                $error_msg      =       "Username exists";
                        }else{
                                $query          =       "INSERT INTO users(username, password, email, acc_active)VALUES('$var_username','$var_password','$var_email','active')";
                                if (mysqli_query($conn, $query)){
                                echo "success";
                                }else{
                                echo "failed". $sql ."<br>". mysqli_error($conn);
                                }
                        }
                }
        }
mysqli_close($conn);
?>

And here is the html form, this is inside a

 <form method="post" action="/rail/register.php?reg=1" style="text-align:center">
                            <input type="text" placeholder="Username..." name="username" />
                            <input type="text" placeholder="Email..." name="email" />
                            <input type="password" placeholder="Password..." name="password" />
                            <input type="password" placeholder="Confirm Password..." name="password-confirm" />

                           <a href="/rail/login">Return / Cancel</a>
                           <input type="submit" name="Register" value="Register" />
                    </form>

So I am reloading the page with value reg=1 to indicate an insert, I am verifying that there are no other records with that username, I am then running insert query

Any help would be much appreciated. Thanks in advance. Ive left the above code very basic at this stage, Ill do error messages, and verification that password/confirm password fields match etc. as well as hashing once basic setup is complete.

Answer 1

<?php
        require "connection.php";
        require "search.php";
        // You can remove the need to escape your strings by using prepared statements.

The check with REG is unnecessary. Best to remove it.

if(isset($_POST['Register'])){

$stmt = $conn->prepare("SELECT null FROM users WHERE username = ? ");
$stmt->bind_param("s", $_POST['username']);
$stmt->execute();
if($stmt->fetch()){
$error = "Username exists.";
}
else{
$error = "";
}
$stmt->close();

if($error == ""){
$param = "Active";
$stmt = $conn->prepare("INSERT INTO users(username, password, email, acc_active) VALUES(?,?,?,?)");
$stmt->bind_param("ssss", $_POST['username'], $_POST['password'], $_POST['email'], $param);
$stmt->execute();
$stmt->close();    
}
else
{
  echo $error;
}

}

Assuming your form is on the same page, you can simply remove the action you add previous. Else you can keep it, but remove the REG.

 <form method="post" action="" style="text-align: center">
       <input type="text" placeholder="Username..." name="username" >
       <input type="text" placeholder="Email..." name="email" />
       <input type="password" placeholder="Password..." name="password">
       <input type="password" placeholder="Confirm Password..." name="password-confirm">

       <a href="/rail/login">Return / Cancel</a>
       <input type="submit" name="Register" value="Register">
  </form>