simple check if user exists

[mlecho]

hi- first post, so i hope this is worthy-
i have a script that checks a mysql db to see if
a- the user exists
b- the password is the same as what was sent from the form

the script below works fine for point b, but what about a? if the user never "registered" (and therefore, is not in the db) how can i check for that? YOu can see in my code where i commented the part that is not working

PHP: Select all

<?php
include("connect/localhost.php");
$un=$_GET['userName'];
$ps=$_GET['password'];

if(!$un || !$ps){
    echo ("not valid");
    return;
}else{
    compareConditions($un,$ps);
}
function compareConditions($un,$ps){
    $sql="SELECT * FROM users WHERE userName='$un'";
    $res=mysql_query($sql)or die(mysql_error());
    while($info= mysql_fetch_assoc($res)){
        if(!$info){
                echo ("user does not exist");
            }//does not work
        if($ps==$info['password']){
            echo $un;
        }else if($ps!=$info['password']){
            incorrect();
        }
        
    }
}
function incorrect(){
    echo ("incorrect username or password");
}
?>

[jimz]

Code: Select all

if($un!=$info['userName']) {
    echo ('user does not exist');
}

That should do the trick

I know you're probably just learning, but using $_GET is not secure, you should use $_POST and your password is not encrypted, but you can look into that later. Just a warning!

Maybe you should make your query like the one below, this way it will only pull out the user if the username and the password are correct:
$sql="SELECT * FROM users WHERE userName='$un' AND password='$ps'";

If you need any more help, give us a yell.

[Kropotkin]

Hi Mlecho

I think the problem is that when there is no matching user name the while loop never executes so you never see your 'user does not exist' message. Specifically:

mysql_fetch_assoc will return false on an empty result set.

Jimz's solution won't work i don't think for the same reason.

You want to check if the query returned anything.

You could try a test:

Code: Select all

mysql_num_rows ($res) > 0

If that is true you know you had a user and now you can check for the password.

Assuming you are enforcing unique user names why are you using a loop at all?

Or use Jimz's SQL solution and do it all in one SQL line but watch out for SQL Injection

In the equivalent Perl DBI module you can test for undefined to see if the result set was empty. I think the above is ok but I'm really not sure what the best way to test for an empty result set should be in PHP.

Justin

[mlecho]

yeah...that does it (with some conditionals)- thanks guys....