我的注册表单中忽略了验证。

Question

I am try to verify fields in the registration form the (password match) the UserID is not taken and the email too.

This is my code

<?php
    if(isset($_POST['submit'])){
        $msg="";
        $id="";
        $name=$_POST['cName'];
        $address=$_POST['cAddrss'];
        $country=$_POST['cCountry'];
        $mobil=$_POST['cTel'];
        $sex=$_POST['cSex'];
        $email=$_POST['cEmail'];
        $userName=$_POST['cUsername'];
        $userPassword=$_POST['cPassword'];
        $confPassword=$_POST['concPassword'];

        $checkEmail=$db->query("select * from users where email ='".$email."'");
        $checkUID=$db->query("select * from users where user_name ='".$userName."'");

        if($userPassword !== $confPassword)
        {
            $msg="Password don't match";
        }
        if($checkEmail -> num_rows == 1)
        {
            $msg = "<span style='color:#F00; font-size:14px; font-weight:bold;'>This email already taken</span>";
        }
        if($checkUID -> num_rows == 1) 
        {
            $msg = "<span style='color:#F00; font-size:14px; font-weight:bold;'>This User name already taken</span>";
        }
        if($put=$db->prepare("INSERT INTO users(id, name, mobile, sex, country, address, user_name, user_password, email)VALUE(?, ?, ?, ?, ?, ?, ?, ?, ?)"))
            {
                $put->bind_param('issssssss', $id, $name, $mobil, $sex, $country, $address, $userName, $userPassword, $email);
                $put->execute();
                $put->close();
            }
            else
            {
                die($db->error);
            }
            header("Location:index.php?pid=3&smsg=smsg");
        }
?>

What happens is the form ignores my Verification and jump to the header and send me to the success page as an everything is fine.

At the top of my form I used this to show the $msg if there is any <?php if(!empty($msg)) {echo $msg;} ?>

Answer 1

Try this approach:

if($userPassword !== $confPassword){
    $msg.="Password don't match";
}else{
    //Password matches, now we can hit the database
    $checkEmail=$db->query("select * from users where email ='".$email."'");
    $checkUID=$db->query("select * from users where user_name ='".$userName."'");

    $emailExist =($checkEmail -> num_rows > 0);
    $userNameExist = ($checkUID -> num_rows > 0);

    if(!$emailExist && !$userNameExist){
        $put=$db->prepare("INSERT INTO users(id, name, mobile, sex, country, address, user_name, user_password, email)VALUE(?, ?, ?, ?, ?, ?, ?, ?, ?)");
        $put->bind_param('issssssss', $id, $name, $mobil, $sex, $country, $address, $userName, $userPassword, $email);
        if($put->execute()){        
          //record Inserted now redirect
          $msg .= "Success! no validation error";
          header("Location:index.php?pid=3&smsg=smsg");
        }else{
         //error
          $msg = "error while INSERT";
          die($db->error);
        }
    }else{
        //found record  
        $msg.= $emailExist ? "This email already taken" : "";
        $msg.= $userNameExist ? "This User name already taken" : "";
    }
}
echo $msg;

---

• Only call DB when password matches
• added success condition
• moved redirection code to success block
• concatenation of error message