mysql_query with PHP variables

Question

This should be easy but I'm can't make it work. The idea is to look for an email adress posted from a form. If it exists echo something and if not echo something else.

My code is:

<?php
//MySQL Database Connect
mysql_connect("localhost", "********", "**********") 
  or die("Unable to connect to MySQL");

//get data from form 
$email=$_POST['email'];

//ask the database for coincidences
 $result = mysql_query("SELECT email FROM pressmails WHERE email='.$email.'"); 
 $num_rows = mysql_num_rows($result); 


 if($num_rows < 0){ 
    echo "The user is registered";
} else { 
    echo "The user is not registered";
}  

 //Close database connection
 mysql_close();
 ?>

The mysql-extension is outdated. Read more php.net/en/mysql-connect. // Oh, and you are obviously introduce some SQL-injections — KingCrunch
– KingCrunch, Commented Jan 22, 2013 at 12:33
Do not use mysql_*. They are deprecated now, and you should get into the habit of using mysqli as a minimum... — BenM
– BenM, Commented Jan 22, 2013 at 12:33
are you getting the message that the user is not registered? i think perhaps your $num_rows<0 is the wrong way round... — Pedro del Sol
– Pedro del Sol, Commented Jan 22, 2013 at 12:34
@BenM You slightly scared me when you mentioned mysqli until I read "as a minimum" ;) — Tim S.
– Tim S., Commented Jan 22, 2013 at 12:34
@Jaume - The syntax for mysqli and mysql functions are very similar, but they are not identical; if you're taking our advice and switching to mysqli, you should read the manual to see how they differ. HINT: mysqli functions require the connection variable, as returned from mysqli_connect(). — SDC
– SDC, Commented Jan 22, 2013 at 12:42

ksg91 · Accepted Answer · 2013-01-22 12:34:08Z

3

You are not concatenating string properly.

$result = mysql_query("SELECT email FROM pressmails WHERE email='.$email.'");

should be

$result = mysql_query("SELECT email FROM pressmails WHERE email='".$email."'");

answered Jan 22, 2013 at 12:34

ksg91

1,29914 silver badges34 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Wouter J · Accepted Answer · 2013-01-22 12:34:34Z

1

You should end the string by using a closing quote (if you started the string with " you must end the string with " too, same for ').

And do not forget to use mysql_real_escape_string, otherwise the script is not safe.

The script will become something like this:

// save the query in a variable, so we can echo it to debug when it doesn't work as expected
$sql = "SELECT email FROM pressmails WHERE email='".mysql_real_escape_string($email)."'";
$result = mysql_query($sql);

answered Jan 22, 2013 at 12:34

Wouter J

42k15 gold badges113 silver badges114 bronze badges

1 Comment

Jaume Over a year ago

Thank you very much. I have tried and it does not work, but if I echo $sql prints the string OK. When I echo $result it prints nothing. I have checked the query at phpmyadmin and it works... THIS IS VERY WEIRD, right???

BenM · Accepted Answer · 2013-01-22 12:35:30Z

1

You do not need the concatenation identifiers, since wrapping a literal in " will automatically parse variables into the string:

$result = mysql_query("SELECT email FROM pressmails WHERE email='$email'");

You should watch out, mind you. Doing the above represents a significant SQL injection vulnerability. You should consider sanitizing $email as a minimum. Also see my comment about the mysql_* functions in PHP.

From the Docs:

This extension is deprecated as of PHP 5.5.0, and will be removed in the future. Instead, the MySQLi or PDO_MySQL extension should be used. See also MySQL: choosing an API guide and related FAQ for more information. Alternatives to this function include:

mysqli_close() PDO: Assign the value of NULL to the PDO object

answered Jan 22, 2013 at 12:35

BenM

53.3k26 gold badges116 silver badges172 bronze badges

2 Comments

Jaume Over a year ago

Thanks for all your help but it still does not work regardless if I use mysql or mysqli. The variable $num_rows is empty when I enter a registered email or an unregistered one... Any idea??? Thanks!!!

BenM Over a year ago

$num_rows will never be less than 0. It will either be 0, or greater. You need to check for if($num_rows > 0)...

Pedro del Sol · Accepted Answer · 2013-01-22 12:37:20Z

0

(assuming you get your syntax errors corrected) isn't the logic of this backwards?

if($num_rows < 0){ 
 echo "The user is registered";
} else { 
echo "The user is not registered";
}

if the user is registered their email is in the database and the query returns one or more rows

try

if($num_rows){ 
   echo "The user is registered";
} else { 
  echo "The user is not registered";
}

answered Jan 22, 2013 at 12:37

Pedro del Sol

2,8419 gold badges43 silver badges52 bronze badges

1 Comment

Wouter J Over a year ago

better is to use $num_rows > 0, apart from that the complete query check is missing and this should be a comment, not an answer.

Collectives™ on Stack Overflow

mysql_query with PHP variables

4 Answers 4

Comments

1 Comment

2 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

1 Comment

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related