檢查重複的用戶帳戶和電子郵件地址

Question

我想檢查一下用戶名或電子郵件地址是否已經存在於我的數據庫中。我目前可以連接到我的數據庫並從註冊表單中檢索數據。但是，我的SQL語句無法檢查我的數據庫以查看用戶是否存在。任何幫助表示讚賞，謝謝。

<?php 

require 'database.php'; 
$conn = Connect(); 

if ($conn == true){ 
    echo "Successfully connected to database. <br><br>";} 

    $username  = $_POST['screenname']; 
    $password  = $_POST['password']; 
    $email   = $_POST['email']; 

    echo "$username<br>"; //just checkin if it can grab data 
    echo "$password<br>"; 
    echo "$email<br>"; 


    $sql=mysql_query("SELECT * FROM users WHERE screenname = '$username'"); 

    if(mysql_num_rows($sql)>=1) 
    { 
     echo "Username already exists"; 
    } 
    else 
    { 
     //insert query goes here 
    } 


    $sql2=mysql_query("SELECT * FROM users WHERE email = '$email'"); 

    if(mysql_num_rows($sql2)>=1) 
    { 
     echo "Email already exists"; 
    } 
     else 
    { 
      //insert query 
    } 


    ?> 

Answer 1

邏輯，編程和安全性（SQL注入攻擊）的錯誤修正：

<?php 

require 'database.php'; 
$conn = Connect(); 

if ($conn == true){ 
    echo "Successfully connected to database. <br><br>"; 
} 

$username  = $_POST['screenname']; 
$password  = $_POST['password']; 
$email   = $_POST['email']; 

echo "$username<br>"; //just checkin if it can grab data 
echo "$password<br>"; 
echo "$email<br>"; 


$sql= sprintf("SELECT * FROM users WHERE screenname='%s' OR email='%s'", 
     mysql_real_escape_string($username), 
     mysql_real_escape_string($email) 
    ); 

if(mysql_num_rows($sql)>=1) 
{ 
    echo "Username or e-mail already exists"; 
} 
else 
{ 
    //insert query goes here 
}