PDA

View Full Version : How do I prevent people updating from inputting emails, etc that already in database?


xprt007
10-23-03, 12:51 PM
Hello all,
I am new to PHP/MySQL and I must say this forum has been helpful and will be for a long time to come.

I however have a problem. I am working on a site where members can register themselves & be able to update their data. Once running, it is supposed to host up to several 10,000 members. Now the problem is this. I managed to combine the 2 tutorials at www.phpfreak.com, ie Membership 2.0 http://www.phpfreaks.com/tutorials/40/0.php & the follow up "Interactive Membership with user ... Interactivity" http://www.phpfreaks.com/tutorials/78/0.php . I customized the profile & password change pages & they are working. The problem is in the case of the profile change, it is assumed that none of the already registered people has similar data in database, like that being added. That is no problem if it is not key inputs like the email address in my case, which should be unique. I managed for example to add code that tells the person that his email is the same as the old if he feeds in the current one.

I have tried but failed to write code that checks the data base & if the "new" email is taken, warns the person & takes him back to the form. That means one can have several people with the same email in the database, after updating. During registration, that's not possible as it's taken care of.

What do I add & where in that code http://www.phpfreaks.com/tutorials/78/6.php??

Attempts to modify the email check element of:

/* Let's do some checking and ensure that the user's email address or username
does not exist in the database */

$sql_email_check = mysql_query("SELECT email_address FROM users
WHERE email_address='$email_address'");
$sql_username_check = mysql_query("SELECT username FROM users
WHERE username='$username'");

$email_check = mysql_num_rows($sql_email_check);
$username_check = mysql_num_rows($sql_username_check);

if(($email_check > 0) || ($username_check > 0)){
echo "Please fix the following errors: <br />";
if($email_check > 0){
echo "<strong>Your email address has already been used by another member
in our database. Please submit a different Email address!<br />";
unset($email_address);
}
if($username_check > 0){
echo "The username you have selected has already been used by another member
in our database. Please choose a different Username!<br />";
unset($username);
}
include 'join_form.html'; // Show the form again!
exit(); // exit the script so that we do not create this account!
}


from http://www.phpfreaks.com/tutorials/40/3.php have failed, probably because I do not know where exactly to place it on the page "changeprofileparse.php".

Please help me!
xprt007

HalfaBee
10-23-03, 05:44 PM
You have to put it near the start of the script before any updates are done.


<?php
session_start();
header("Cache-control: private");
$username = $_SESSION['username'];
include ("var/db.inc");



// check email addr here and stop if already used.




if ($_POST['name'] != "") {
$name = htmlspecialchars($_POST['name']);
mysql_query("UPDATE users SET name='$name' WHERE username='$username'") or die (mysql_error());
$_SESSION['name'] = $name;
$cname = "<li>artist name</li>";
}

xprt007
11-9-03, 10:43 AM
Thanks. Actually I thought what u suggested was logical, only that I could not come up with functioning code to be placed there. I got the following code from another forum & it helped, with some few modifications.:

would look something like this after you make the email column unique:

if ($_POST['email'] != "") {
//check if it looks like an email
if (!eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,4})$", $_POST['email'])){
die('This email address appears to be the wrong format.');
}else{
$email = htmlspecialchars($_POST['email']);
if(! $result = mysql_query("UPDATE users SET email='$email' WHERE username='$username'")){
$errnum = mysql_errno();
switch($errnum){
case 1062:
die('That email address is already registered to another user.');
break;
default:
die(mysql_error().' '.mysql_errno());
break;
}
}else{
$_SESSION['email'] = $email;
}
}
}



Regards,
xprt007