I'm using the following code to check if a user already exists in a MySQL database, but every time I try to create a new account with an username that has been already chosen, it lets me create it instead of returning an error message.
<?php
if(isset($_POST['B1'])){
$user=$_POST['U'];
$email=$_POST['email'];
$pass=$_POST['P'];
$cpass=$_POST['CP'];
if($user!=null && $pass!=null && $cpass!=null && $email!=null){
if($pass==$cpass){
$sql="SELECT FROM users (username, email, password) WHERE username='$user'";
$checkuser=mysql_query($sql);
if(mysql_num_rows($checkuser)>0){
echo"This username has been already taken.";
}else{
$query="INSERT INTO users(username, email, password) VALUES('$user','$email',md5('$pass'))";
$result=mysql_query($query) or die("error3");
mysql_close();
echo "<center><h2>Thanks for have joined us, ".$user."!</h2><br></center>";
echo"<center><h2>You are now ready to use your account.</h2><br></center>";
echo"<center><a href='login.php' class='button specialp'>Let's get started</a></center>";
}
}
}else{
echo"<center><p><h2>Oops, something went wrong!<h2></p></center>";
echo"<center><a href='signup.php' class='button specialp'>Try again</a></center>";
}
}
?>
What am I doing wrong?
In your code section,
$sql="SELECT username, email, password FROM users WHERE username='$user'";
$checkuser=mysql_query($sql);
if(mysql_num_rows() > 0) {
......
try to replace that part above of code and see