没有收到错误

Question

I've an member system now I've made when somebody register an account, he need to activate it by his email. He will receive an valid link in his inbox So for example: activate.php?email=[e-mail]&email_code=b5b90ae21e31229878d681680db16bdf This link is valid so when I go to this link, he activates the account succesfully.

You see after ?email= [e-mail] So when I change that into [e-mail] and the email_code is still the same, he cannot activate his account. He needs to receive an error like We cannot find that email, and when he changes the email_code He will receive an error like this problem activate your account

Thats the problem what I've got When I change the email I don't receive any error. Neither for email_code

I've a file that is called activate.php which this code is including:

<?php
} else if (isset($_GET['email'], $_GET['email_code']) === true) {
    $email  = urldecode(trim($_GET['email']));
    $email_code = trim($_GET['email_code']);
    $user = new User();
    if(User::email_exists($email) === false) {
        echo 'We cannot find that email'; // return error doesn't show up
    } else if (User::activate($email, $email_code) === false) {
        echo 'problem activate your account'; // return error doesn't show up
    }

}

?>

Also I've 2 functions made, there are in the class file User.php

public function email_exists($email) {  
    require './config.php';     
    $email  = urldecode(trim($_GET['email']));  
    $sql_30 =   $db->query("SELECT COUNT(id) FROM users WHERE email = '$email'");   
    if ($sql_30->fetch_object() === true) {         
        return true;    
    } else if ($sql_30->fetch_object() === false) {         
        return false;   
    }   
}



public function activate($email, $email_code) {
    require './config.php';
    $email  = urldecode($email);
    $email_code = $db->real_escape_string($email_code);
    $sql_33 = $db->query("SELECT COUNT(`id`) FROM `users` WHERE `email` = '$email' AND `email_code` = '$email_code' AND `group` = 0");
    if ($sql_33->fetch_object()) {
        $db->query("UPDATE `users` SET `group` = 1 WHERE `email` = '$email' AND `email_code` = '$email_code'");
        return true;
    } else {
        return false;
    }
}

Answer 1

To me, your email_exists() and activate() are wrong.

if ($sql_30->fetch_object() === true) {         
        return true;    
} else if ($sql_30->fetch_object() === false) {         
        return false;   
}  

From the php documentation of mysqli_result::fetch_object : Returns an object with string properties that corresponds to the fetched row or NULL if there are no more rows in resultset. So your test must be :

if ($sql_30->fetch_object() !== NULL) {         
        return true;    
} 
return false;

I guess it should solve your problem.