Check if username in the table with password in php

Question

I have a table with users name, this table have 2 column (username and password).
Suppose i have 2 record in this table. For example:

user1 is username with 1234 for password user2 with null password

The following code checks if there username has a value.

If it has a value: $response = "Yes"
If username not exist: $response = "No"

Now i want check if username exist with null password , then set

$response="No"

Here is my Code

$link = mysql_connect($server,$user,$pass);
mysql_select_db($db);
$response = 'no';
if(isset($_POST['username']) && trim($_POST['username']) != ''){
 $query = mysql_query("SELECT * FROM prochatrooms_users WHERE username = '".mysql_escape_string(trim($_POST['username']))."'", $link);
 if(mysql_num_rows($query) > 0){
  $response = 'yes';
 }
}
echo json_encode(array('exists' => $response));

Duplicate of http://stackoverflow.com/questions/21521497/how-to-check-table-for-empty-in-php/21522432 by OP — AyB, Feb 03 '14 at 08:13
where you are checking the password. It will return yes always if username exists and password is what else. — عثمان غني, Feb 03 '14 at 08:15

score 0 · Accepted Answer · answered Feb 03 '14 at 08:32

just add AND password !='' this line to your query

$link = mysql_connect($server,$user,$pass);
mysql_select_db($db);
$response = 'no';
if(isset($_POST['username']) && trim($_POST['username']) != ''){
 $query = mysql_query("SELECT * FROM prochatrooms_users WHERE username = '".mysql_escape_string(trim($_POST['username']))."' AND password !='' ", $link);
 if(mysql_num_rows($query) > 0){
  $response = 'yes';
 }
}
echo json_encode(array('exists' => $response));

check the answer i have added that condition to your query – krishna Feb 03 '14 at 08:45 — krishna, Feb 03 '14 at 08:45

score 0 · Answer 2 · edited May 23 '17 at 12:21

Well as a first tip, do not use query concatenation when working with SQL. I strongly suggest using this approach instead: How can I prevent SQL injection in PHP?. Your method makes your login system heavily vulnerable to SQL injections and attackers.

If you want to check if your password is null, you can try this approach:

if ( trim($_POST['password']) == '') {
      $response = 'no';
}

Check if username in the table with password in php

2 Answers2