0

Trying to Insert users into my user table in php. Insert query doesn't seem to run. I tried to manually add email id, it checks for duplicate email id and does throw error stating email id exists, but for some reason it does not insert into data base. Any Suggestions ?`

<?php
$error = "";
if(array_key_exists("submit",$_POST )){


    $link = mysqli_connect ("localhost", "root","","secretdi");

    if (mysqli_connect_error()){
        die ("Connection to Database failed!");
    }

    print_r($_POST);

    if (!$_POST ['email']){
         $error .= "Email Address is required<br>";
    }
    if (!$_POST ['password']){
         $error .= "Password is required<br>";
    }
    if ($error != ""){
        $error = "<p>There were Error(s) in your form <p>".$error;
    }else {
        $query = "SELECT id FROM `users` WHERE `email` = '".mysqli_real_escape_string($link,$_POST['email'])."' LIMIT 1 ";


        $result = mysqli_query ($link, $query );

        if (mysqli_num_rows($result) > 0){
           $error = "That Email Address is already taken. Try to Log In ";

        }else {
            $query = "INSERT INTO `users` (`email`,`password`)VALUES ('".mysqli_real_escape_string($link, $_POST["email"])."','".mysqli_real_escape_string($link, $_POST["password"])."')";

        }
            if (!mysqli_query($link, $query )){
                $error = "Could Not Sign You Up! Please Try Again Later. ";
            } else{
                echo "Sign-Up Successfull.";
            }
        }
    }


?>

<div id = "error" > <?php echo $error; ?> </div>
<form method="post">
    <input type = "email" name = "email" placeholder = " Your Email">
    <input type = "password" name = "password" >
    <input type = "checkbox" name = "checkbox">
    <input type = "submit" name = "submit" value = "Sign - Up">
</form>`
KshitijAnil Rangari
  • 176
  • 1
  • 4
  • 17
  • 1
    **Never store plain text passwords!** Please use PHP's [built-in functions](http://jayblanchard.net/proper_password_hashing_with_PHP.html) to handle password security. If you're using a PHP version less than 5.5 you can use the `password_hash()` [compatibility pack](https://github.com/ircmaxell/password_compat). Make sure you ***[don't escape passwords](http://stackoverflow.com/q/36628418/1011527)*** or use any other cleansing mechanism on them before hashing. Doing so *changes* the password and causes unnecessary additional coding. – Jay Blanchard Jan 25 '17 at 19:44
  • [Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)*** Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! [Don't believe it?](http://stackoverflow.com/q/38297105/1011527) – Jay Blanchard Jan 25 '17 at 19:44
  • Have you checked your error logs? You're making an assumption the query is working. Add error reporting to the top of your file(s) right after your opening ` – Jay Blanchard Jan 25 '17 at 19:45
  • I am guessing your last if-else block should be inside the preceding else block. – Uueerdo Jan 25 '17 at 19:49
  • @KshitijAnil are you using `id` field as **autoincrement** and **primary key** in your database – Prashant Pokhriyal Jan 25 '17 at 20:28
  • if (!mysqli_query($link, $query )){ $error = "Could Not Sign You Up! Please Try Again Later. " . mysqli_error($link); } else { echo "Sign-Up Successfull."; } I added error check code and it returned with " Field 'secretdi' doesn't have a default value" what does this mean ? – KshitijAnil Rangari Jan 25 '17 at 23:09
  • `users` evidently has a NOT NULL field without a default value called `secretdi` (if that is not a typo); you cannot omit such fields from INSERT statements. – Uueerdo Jan 26 '17 at 00:00

0 Answers0