-1

Hello i want to create php code to verify if some email that user enters is already in the database and i don t know how. this is my code and what i have tried. I'm doing something wrong at if statement but i don't know what i'm doing wrong, how i can select emails from my database and compare it to $email variable who is from my email textbox in the website

                   $dbServerName = "localhost";
                    $dbUsername = "root";
                    $dbPassword = "1234";
                    $dbName="licenta";

                    $prenume = $_POST["prenume"];
                    $nume = $_POST["nume"];
                    $telefon = $_POST["telefon"];
                    $email = $_POST["email-signin"];
                    $parola = $_POST["parola-signin"];
                    $reintroducetiParola = $_POST["reintroduceti-parola-signin"];
                    //$bifaProcesareDate = $_POST["bifa-procesare-date"];
                    $butonSubmitCreareCont = $_POST["creaza-cont-client-btn"];

                    $conn = new mysqli($dbServerName,$dbUsername,$dbPassword,$dbName);
                    mysqli_select_db($conn, $dbName);
            
                    $sql = "SELECT email FROM conturi WHERE email='$email'";
                    $result = mysqli_query($conn, $sql);
                    if($result == $email){
                            echo "Email already exists";
                        }
                    else {
                    $insert = "INSERT INTO conturi (prenume, nume, telefon, email, parola, reintroducetiParola) VALUES ('$prenume', '$nume', '$telefon','$email', '$parola', '$reintroducetiParola')";
                    $result=mysqli_query($conn, $insert);
                    echo "Your account has been added succesfully!";
                    mysqli_close($conn);
                    }
programmerjavascript
  • 1
  • 1. You have `if($result == $email){`. What does `$result` contain, ie. what does [`mysqli_query`](https://www.php.net/mysqli_query) return? 2. Your queries are vulnerable to [SQL Injection](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php), use prepared statements. – Markus AO May 05 '22 at 16:12
  • **Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/32391315) – Dharman May 05 '22 at 16:16

0 Answers0