使用 php 检查 mysql table 中的现有用户

Question

我已经尝试了好几天了，但代码有问题。我正在尝试 tp learn php 和 mysql/MariaDB，并且正在开发一个允许管理员和用户使用的多用户登录系统。

到目前为止我有以下工作：

用户可以注册
如果已经注册，用户可以登录和注销（根据用户级别定向到索引页面
管理员根据管理员级别被定向到“管理员”主页
管理员可以从管理区域创建新用户（用户级别无访问权限）
注册页面和管理员创建用户页面之间的唯一区别是管理员创建用户页面允许分配用户或管理员的角色（注册页面上没有此选项）

我运行遇到的问题是我想添加一个检查以防止用户名重复（新注册的用户或管理员创建的用户如果名称已被占用则无法创建新用户).我已尝试插入支票以查看，但即使该用户名已存在，它仍会添加用户。

我想知道是否有人可以查看我的代码，看看我哪里出错了。

这是我的管理员创建用户代码：

<?php include('../functions.php') ?>

if (!isAdmin()) {
    $_SESSION['msg'] = "You must log in first";
    header('location: ../login.php');
}
<!DOCTYPE html>
<html>
<head>
    <title>Registration system PHP and MySQL - Create user</title>
    <link rel="stylesheet" type="text/css" href="../style.css">
    <style>
        .header {
            background: #003366;
        }
        button[name=register_btn] {
            background: #003366;
        }
    </style>
</head>
<body>
    <div class="header">
        <h2>Admin - create user</h2>
    </div>
    
    <form method="post" action="create_user.php">

        <?php echo display_error(); ?>

        <div class="input-group">
            <label>Username</label>
            <input type="text" name="username" value="<?php echo $username; ?>">
        </div>
        <div class="input-group">
            <label>Email</label>
            <input type="email" name="email" value="<?php echo $email; ?>">
        </div>
        <div class="input-group">
            <label>User type</label>
            <select name="user_type" id="user_type" >
                <option value=""></option>
                <option value="admin">Admin</option>
                <option value="user">User</option>
            </select>
        </div>
        <div class="input-group">
            <label>Password</label>
            <input type="password" name="password_1">
        </div>
        <div class="input-group">
            <label>Confirm password</label>
            <input type="password" name="password_2">
        </div>
        <div class="input-group">
            <button type="submit" class="btn" name="register_btn"> + Create user</button>
        </div>
    </form>
</body>
</html>


    **Here is Register page:**
    <?php include('functions.php') ?>
    <!DOCTYPE html>
    <html>
    <head>
        <title>Registration system PHP and MySQL</title>
        <link rel="stylesheet" href="style.css">
    </head>
    <body>
    <div class="header">
        <h2>Register</h2>
    </div>
    <form method="post" action="register.php">
        <?php echo display_error(); ?>
        <div class="input-group">
                        <label for="username" class="col-md-3 control-label">User Name*</label>
                        <div class="col-md-9">
                            <input type="username" class="form-control" name="username" placeholder="User Name" required>
                        </div>
                    </div>
        <div class="input-group">
            <label for="email" class="col-md-3 control-label">Email*</label>
            <div class="col-md-9">
            <input type="email" class="form-control" name="email" placeholder="Email" required>
            </div>
        </div>
        <div class="input-group">
            <label for="password" class="col-md-3 control-label">Password</label>
            <div class="col-md-9">
            <input type="password" class="form-control" name="password_1" placeholder="Password" required>
            </div>
        </div>
        <div class="input-group">
            <label for="password" class="col-md-3 control-label">Confirm password</label>
            <div class="col-md-9">
            <input type="password" class="form-control" name="password_2" placeholder="Password" required>
            </div>
        </div>
        <div class="input-group">
            <button type="submit" class="btn" name="register_btn">Register</button>
        </div>
        <p>
            Already a member? <a href="login.php">Sign in</a>
        </p>
    </form>
    </body>
    </html>

以下是我的所有功能：

    <?php 
session_start();

// connect to database
$db = mysqli_connect('removed variables to connect to database this works');

// variable declaration
$username = "";
$email    = "";
$errors   = array(); 

// call the register() function if register_btn is clicked
if (isset($_POST['register_btn'])) {
    register();
}

function register(){
    // call these variables with the global keyword to make them available in function
    global $db, $errors, $username, $email;

    // receive all input values from the form. Call the e() function
    // defined below to escape form values
    $username    =  e($_POST['username']);
    $email       =  e($_POST['email']);
    $password_1  =  e($_POST['password_1']);
    $password_2  =  e($_POST['password_2']);
    
    $sql= "SELECT * FROM users WHERE username = '$username'";

$result=mysqli_query($sql);

if(mysqli_num_rows($result)!=0)
       {
        echo"name already exists";
}

    // form validation: ensure that the form is correctly filled
    if (empty($username)) { 
        array_push($errors, "Username is required"); 
    }
    if (empty($email)) { 
        array_push($errors, "Email is required"); 
    }
    if (empty($password_1)) { 
        array_push($errors, "Password is required"); 
    }
    if ($password_1 != $password_2) {
        array_push($errors, "The two passwords do not match");
    }

    // register user if there are no errors in the form
    if (count($errors) == 0) {
        $password = hash('sha256', $password_1);//encrypt the password before saving in the database
        // excecute insert query 

        if (isset($_POST['user_type'])) {
            $user_type = e($_POST['user_type']);
            $query = "INSERT INTO users (username, email, user_type, password) 
                      VALUES('$username', '$email', '$user_type', '$password')";
            mysqli_query($db, $query);
            $_SESSION['success']  = "New user successfully created!!";
            header('location: home.php');
        }else{
            $query = "INSERT INTO users (username, email, user_type, password) 
                      VALUES('$username', '$email', 'user', '$password')";
            mysqli_query($db, $query);

            // get id of the created user
            $logged_in_user_id = mysqli_insert_id($db);

            $_SESSION['user'] = getUserById($logged_in_user_id); // put logged in user in session
            $_SESSION['success']  = "You are now logged in";
            header('location: index.php');              
        }
    }

}
            // ge

// return user array from their id
function getUserById($id){
    global $db;
    $query = "SELECT * FROM users WHERE id=" . $id;
    $result = mysqli_query($db, $query);

    $user = mysqli_fetch_assoc($result);
    return $user;
}

// escape string
function e($val){
    global $db;
    return mysqli_real_escape_string($db, trim($val));
}

function display_error() {
    global $errors;

    if (count($errors) > 0){
        echo '<div class="error">';
            foreach ($errors as $error){
                echo $error .'<br>';
            }
        echo '</div>';
    }
}

function isLoggedIn()
{
    if (isset($_SESSION['user'])) {
        return true;
    }else{
        return false;
    }
}

// log user out if logout button clicked
if (isset($_GET['logout'])) {
    session_destroy();
    unset($_SESSION['user']);
    header("location: login.php");
}

// call the login() function if register_btn is clicked
if (isset($_POST['login_btn'])) {
    login();
}

// LOGIN USER
function login(){
    global $db, $username, $errors;

    // grap form values
    $username = e($_POST['username']);
    $password = e($_POST['password']);

    // make sure form is filled properly
    if (empty($username)) {
        array_push($errors, "Username is required");
    }
    if (empty($password)) {
        array_push($errors, "Password is required");
    }

    // attempt login if no errors on form
    if (count($errors) == 0) {
        $password = hash(sha256, $password);

        $query = "SELECT * FROM users WHERE username='$username' AND password='$password' LIMIT 1";
        $results = mysqli_query($db, $query);

        if (mysqli_num_rows($results) == 1) { // user found
            // check if user is admin or user
            $logged_in_user = mysqli_fetch_assoc($results);
            if ($logged_in_user['user_type'] == 'admin') {

                $_SESSION['user'] = $logged_in_user;
                $_SESSION['success']  = "You are now logged in";
                header('location: admin/home.php');       
            }else{
                $_SESSION['user'] = $logged_in_user;
                $_SESSION['success']  = "You are now logged in";

                header('location: index.php');
            }
        }else {
            array_push($errors, "Wrong username/password combination");
        }
    }
}

function isAdmin()
{
    if (isset($_SESSION['user']) && $_SESSION['user']['user_type'] == 'admin' ) {
        return true;
    }else{
        return false;
    }
}

我一直在添加代码的函数是注册函数正如你所看到的，我从我的用户table中选择了所有并将其分配给一个变量（用户名变量是在它上面分配的Post 操作。然后我对该变量进行了 mysqli 查询并将其分配给另一个变量。然后我试图说如果行数不等于零，则用户名存在。

我不确定我做错了什么。如果有人可以提供一些见解，请告诉我。我知道这段代码可能不是最好的。我正在我的本地环境中尝试这个来学习。任何建议将不胜感激。

提前致谢。

Answer 1

问题出在mysqli_query函数中，这个函数至少需要2个参数，第一个是你数据库的link，所以你的代码应该是这样的：

$connection = mysqli_connect("localhost","db_user","db_password","db_name");

/* your code */

$result=mysqli_query($connection, $sql);

使用 php 检查 mysql table 中的现有用户

checking for existing user in mysql table using php

php

mysql

mysqli