PHP MySql - Check if value exists

Question

Need to check if both the EMAIL_ADDRESS and ACTIVATION_CODE exist within a MySql Table, if so return "Code is valid",else "Code is NOT valid".

At present it's always returning code not valid, however I've checked the record in the table and the queried code does exist.

$email = $_POST['email'];
$acticode = $_POST['code'];


$result = mysql_query("SELECT * FROM xActivate WHERE EMAIL_ADDRESS='$email' AND ACTIVATION_CODE='$acticode' LIMIT 1");

 if (mysql_fetch_row($result)) {
    echo 'Code is valid';
} else {
    echo 'Code is NOT valid';
}

Try with the email address ' OR 1=1 --. Then it'll work. Else try to ask mysql_error() and read up on escaping, or parameterized queries. — mario
– mario, Commented Apr 13, 2014 at 3:07
Can you echo out the query and run it manually to verify everything is correct? Maybe the column names should be lower case? — Brandon - Free Palestine
– Brandon - Free Palestine, Commented Apr 13, 2014 at 3:08
@mario Should there not be a DROP ALL TABLES thrown in for good measure? — ScottMcGready
– ScottMcGready, Commented Apr 13, 2014 at 3:11
@mario where should I insert these? $result = mysql_query("SELECT * FROM xActivate WHERE EMAIL_ADDRESS='$email' AND ACTIVATION_CODE='$acticode' LIMIT 1"); — TheDoonker
– TheDoonker, Commented Apr 13, 2014 at 3:14

Community · Accepted Answer · 2023-11-17 19:20:55Z

3

But this code is not secure:

$email = $_POST['email'];
$acticode = $_POST['code'];


$result = mysql_query("SELECT * FROM xActivate WHERE EMAIL_ADDRESS='$email' AND ACTIVATION_CODE='$acticode' LIMIT 1");
$data = mysql_fetch_row($result);
 if (mysql_num_rows($result) > 0) {
    echo 'Code is valid';
} else {
    echo 'Code is NOT valid';
}

To secure and prevent SQL Injection:

$email = mysql_real_escape_string($_POST['email']);
$acticode = mysql_real_escape_string($_POST['code']);

Please note:

https://www.php.net/mysql_real_escape_string

Warning

This extension is deprecated as of PHP 5.5.0, and will be removed in the future. Instead, the MySQLi or PDO_MySQL extension should be used. See also MySQL: choosing an API guide and related FAQ for more information. Alternatives to this function include:
    mysqli_real_escape_string()
    PDO::quote()

edited Nov 17, 2023 at 19:20

CommunityBot

11 silver badge

answered Apr 13, 2014 at 3:08

CMPS

7,7874 gold badges32 silver badges53 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

RobP Over a year ago

mysql is deprecated, use mysqli. Also, use bindParam() for the $email and $acticode parameters.

CMPS Over a year ago

Yes I am aware of this warning, I will leave a Note in my answer. Thank you

Collectives™ on Stack Overflow

PHP MySql - Check if value exists

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related