PHP username validation against MySQL

Question

Plenty of time, spent, here is where I'm at:

    $uname_query = mysql_query("SELECT username FROM blog_members WHERE username='".$username."'");         

    if ($uname_query == $username) {
        $error[] = 'Username is already taken';
    }

I'm trying to use the SQL query $uname_query to pull the $username entered in a form, if it exists, then use an if statement to display the error, if it exists.

As it is coded right now, I get no error but also no functionality.

What am I missing?

I wouldn't do a select because that would build a race condition. Better use an unique index on the column username, try an INSERT. If all went well, that's ok. If you get an index violation error, then give your error message. — VMai
– VMai, Commented Apr 11, 2014 at 22:02
@VMai what if he wants to check before the insert is ready? Like while the user is filling out the signup form? I don't see any issue with a this select if the username is the primary key or unique. — Devon Bessemer
– Devon Bessemer, Commented Apr 11, 2014 at 22:17

Devon Bessemer · Accepted Answer · 2014-04-11 22:05:57Z

3

You need to use a fetch.

$row = mysql_fetch_row($uname_query);
// $row[0] will contain the first column of the first row (username)
if ($row[0] == $username) { }

However, you should look at using PDO or MySQLi since the MySQL api is deprecated. You should also use prepared statements if $username is provided by the user.

In PDO you could do:

$stmt = $pdo->prepare("SELECT username FROM blog_members WHERE username=?");
$stmt->execute(array($username));
// fetchColumn will return the first column of the first row (username)
if ($stmt->fetchColumn() == $username) { }

This protects against SQL injections by providing a prepared statement without $username and binding it in the execute() function. PDO requires some different setup initially too, but here is a good tutorial: http://wiki.hashphp.org/PDO_Tutorial_for_MySQL_Developers

edited Apr 11, 2014 at 22:05

answered Apr 11, 2014 at 22:00

Devon Bessemer

35.6k10 gold badges77 silver badges102 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

phamousphil Over a year ago

The PDO method worked well for me. My database was setup as $db and used elsewhere in my code, so by changing $pdo to $db I was able to copy and paste this code with success. Thank you!

Abhik Chakraborty · Accepted Answer · 2014-04-11 22:00:14Z

1

You have to fetch the data before compare as

$row = mysql_fetch_array( $uname_query);
if($row["username"] == $username){
  $error[] = 'Username is already taken';
}

answered Apr 11, 2014 at 22:00

Abhik Chakraborty

44.9k6 gold badges56 silver badges63 bronze badges

1 Comment

phamousphil Over a year ago

When I try this I get the following error: Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given

Ko Cour · Accepted Answer · 2014-04-11 22:00:22Z

0

You need to fetch the data from the query first.

$uname_query = mysql_query("SELECT username FROM blog_members WHERE username='".$username."'");         
$arr=mysql_fetch_array($uname_query);
if ($arr["username"] == $username) {
  $error[] = 'Username is already taken';
}

answered Apr 11, 2014 at 22:00

Ko Cour

9432 gold badges18 silver badges29 bronze badges

Comments

Shahar · Accepted Answer · 2014-04-11 22:01:00Z

0

For one, you need to fetch it. Use mysql_fetch_row(). Secondly, I'm not sure what that $error[]='string' business is. Are you trying to use an array?

Although I suggest moving to mysqli since mysql is deprecated. Also, I hope you sanitized that string well.

answered Apr 11, 2014 at 22:01

Shahar

1,6772 gold badges12 silver badges18 bronze badges

Collectives™ on Stack Overflow

PHP username validation against MySQL

4 Answers 4

1 Comment

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

1 Comment

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related