我如何告诉用户他们的电子邮件已被注册？

Question

我在数据库中的电子邮件列上放置了唯一索引，当我输入已注册的电子邮件时，数据库不会更新。这样效果很好。我现在需要告诉用户输入已经存在的电子邮件（在注册页面上），它已经注册并将他们重定向到主页。

请检查我的 SQL 注入代码，如果有任何错误，请更正。

<?php

$fullname = $_POST['fullname'];

$email = $_POST['email'];

$mobilenumber = $_POST['mobilenumber'];

//prevent sql injection

$fullname = stripslashes($fullname);

$email = stripcslashes($email);

$mobilenumber = stripslashes($mobilenumber);

$fullname = mysql_real_escape_string($fullname);

$email = mysql_real_escape_string($email);

$mobilenumber = mysql_real_escape_string($mobilenumber);

//Database Connection

$conn = new mysqli("#","#","#","#");

if($conn->connect_error){

    die('connection Failed : '.$conn->connect_error);

}else{

        $stmt = $conn->prepare("insert into signup(fullname,email,mobilenumber)values(?,?,?)");

        $stmt->bind_param("ssi",$fullname,$email,$mobilenumber);

        $stmt->execute();

        header("Location:thankyou.html");

        $stmt->close();

        $conn->close();

}

?>

Answer 1

根据评论 - 如果您select在尝试执行之前做一个简单的操作，insert则可以分叉程序逻辑并让用户知道。<?php&nbsp; &nbsp; if( $_SERVER['REQUEST_METHOD']=='POST' && isset(&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; $_POST['fullname'],&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; $_POST['email'],&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; $_POST['mobilenumber']&nbsp;&nbsp; &nbsp; )){&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; $fullname = $_POST['fullname'];&nbsp; &nbsp; &nbsp; &nbsp; $email = $_POST['email'];&nbsp; &nbsp; &nbsp; &nbsp; $mobilenumber = $_POST['mobilenumber'];&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; $dbport =&nbsp; &nbsp;3306;&nbsp; &nbsp; &nbsp; &nbsp; $dbhost =&nbsp; &nbsp;'localhost';&nbsp; &nbsp; &nbsp; &nbsp; $dbuser =&nbsp; &nbsp;'dbo-user-xxx';&nbsp; &nbsp; &nbsp; &nbsp; $dbpwd&nbsp; =&nbsp; &nbsp;'dbo-pwd-xxx';&nbsp; &nbsp; &nbsp; &nbsp; $dbname =&nbsp; &nbsp;'db-xxx';&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; error_reporting( E_ALL );&nbsp; &nbsp; &nbsp; &nbsp; mysqli_report( MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT );&nbsp; &nbsp; &nbsp; &nbsp; $conn = new mysqli( $dbhost, $dbuser, $dbpwd, $dbname );&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; try{&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; #check email before insert&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $sql='select `email` from `signup` where `email`=?';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt=$conn->prepare( $sql );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->bind_param('s',$email);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->execute();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->store_result();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if( $stmt->num_rows==0 ){&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; /* email does not exist - perform insert */&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $sql='insert into `signup` ( `fullname`, `email`, `mobilenumber` ) values ( ?, ?, ? )';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt=$conn->prepare( $sql );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->bind_param('sss', $fullname, $email, $mobilenumber );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->execute();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->close();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $conn->close();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; exit( header('Location: thankyou.html') );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }else{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; /* email does exist - tell user */&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->free_result();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $stmt->close();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; exit( header('Location: ?error=true&email=true' ) );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; }catch( mysqli_sql_exception $e ){&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; exit( $e->getMessage() );&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }?>或者，您可以try/catch像以前一样但使用返回错误代码来分叉逻辑<?php&nbsp; &nbsp; /*&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; mysql> describe signup;&nbsp; &nbsp; &nbsp; &nbsp; +--------------+------------------+------+-----+---------+----------------+&nbsp; &nbsp; &nbsp; &nbsp; | Field&nbsp; &nbsp; &nbsp; &nbsp; | Type&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;| Null | Key | Default | Extra&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |&nbsp; &nbsp; &nbsp; &nbsp; +--------------+------------------+------+-----+---------+----------------+&nbsp; &nbsp; &nbsp; &nbsp; | id&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;| int(10) unsigned | NO&nbsp; &nbsp;| PRI | NULL&nbsp; &nbsp; | auto_increment |&nbsp; &nbsp; &nbsp; &nbsp; | fullname&nbsp; &nbsp; &nbsp;| varchar(50)&nbsp; &nbsp; &nbsp; | NO&nbsp; &nbsp;|&nbsp; &nbsp; &nbsp;| NULL&nbsp; &nbsp; |&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |&nbsp; &nbsp; &nbsp; &nbsp; | email&nbsp; &nbsp; &nbsp; &nbsp; | varchar(64)&nbsp; &nbsp; &nbsp; | NO&nbsp; &nbsp;| UNI | NULL&nbsp; &nbsp; |&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |&nbsp; &nbsp; &nbsp; &nbsp; | mobilenumber | varchar(16)&nbsp; &nbsp; &nbsp; | NO&nbsp; &nbsp;|&nbsp; &nbsp; &nbsp;| NULL&nbsp; &nbsp; |&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |&nbsp; &nbsp; &nbsp; &nbsp; +--------------+------------------+------+-----+---------+----------------+&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; mysql> select * from signup;&nbsp; &nbsp; &nbsp; &nbsp; +----+----------+-----------------------------+--------------+&nbsp; &nbsp; &nbsp; &nbsp; | id | fullname | email&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;| mobilenumber |&nbsp; &nbsp; &nbsp; &nbsp; +----+----------+-----------------------------+--------------+&nbsp; &nbsp; &nbsp; &nbsp; |&nbsp; 1 | fred&nbsp; &nbsp; &nbsp;| [e-mail] | 123&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |&nbsp; &nbsp; &nbsp; &nbsp; +----+----------+-----------------------------+--------------+&nbsp; &nbsp; */&nbsp; &nbsp; /* Attempt to insert duplicate - but use error code 1062 to fork the logic */&nbsp; &nbsp; $dbport =&nbsp; &nbsp;3306;&nbsp; &nbsp; $dbhost =&nbsp; &nbsp;'localhost';&nbsp; &nbsp; $dbuser =&nbsp; &nbsp;'dbo-user-xxx';&nbsp; &nbsp; $dbpwd&nbsp; =&nbsp; &nbsp;'dbo-pwd-xxx';&nbsp; &nbsp; $dbname =&nbsp; &nbsp;'db-xxx';&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; /* same email and phone number but different fullname */&nbsp; &nbsp; $email='[e-mail]';&nbsp; &nbsp; $fullname='freddy boy';&nbsp; &nbsp; $mobilenumber=123;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; error_reporting( E_ALL );&nbsp; &nbsp; mysqli_report( MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT );&nbsp; &nbsp; $conn = new mysqli( $dbhost, $dbuser, $dbpwd, $dbname );&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; try{&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; $sql='insert into `signup` ( `fullname`, `email`, `mobilenumber` ) values ( ?, ?, ? )';&nbsp; &nbsp; &nbsp; &nbsp; $stmt=$conn->prepare( $sql );&nbsp; &nbsp; &nbsp; &nbsp; $stmt->bind_param('sss', $fullname, $email, $mobilenumber );&nbsp; &nbsp; &nbsp; &nbsp; $stmt->execute();&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; }catch( mysqli_sql_exception $e ){&nbsp; &nbsp; &nbsp; &nbsp; if( $e->getCode()==1062 ){&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; /* redirect the user and let them know the email already exists */&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; exit( header( sprintf('Location: ?error=%s',$e->getMessage() ) ) );&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;?>

Answer 2

&nbsp; // first check the database to make sure&nbsp;&nbsp; // a email does not already exist with the same&nbsp; email&nbsp; $fullname = $_POST['fullname'];&nbsp; $email = $_POST['email'];&nbsp; $mobilenumber = $_POST['mobilenumber'];&nbsp; $user_check_query = "SELECT * FROM signup WHERE email='$email'LIMIT 1";&nbsp; $result = mysqli_query($cons, $user_check_query);&nbsp; $emailcheck= mysqli_fetch_assoc($result);&nbsp;&nbsp;&nbsp; if ($emailcheck) { // if email exists&nbsp; &nbsp; if ($emailcheck['email'] === $email) {&nbsp; &nbsp; &nbsp; array_push($errors, "email already exists");&nbsp; &nbsp; header('location: index.php');&nbsp; &nbsp; }&nbsp; }&nbsp; // Finally, register user if there are no errors in the form&nbsp; if (count($errors) == 0) {&nbsp; &nbsp; &nbsp;$sql = "insert into&nbsp;&nbsp; &nbsp; &nbsp;signup(fullname,email,mobilenumber)values($fullname,$email,$mobilenumber)";&nbsp; &nbsp; &nbsp;$runsql = mysqli_query($cons, $sql);&nbsp; &nbsp; if($runsql) {&nbsp; &nbsp; &nbsp; &nbsp; header("Location:thankyou.html");&nbsp; &nbsp; } else {&nbsp; &nbsp; &nbsp; &nbsp; echo"Some thing is wrong";&nbsp; &nbsp; }&nbsp; }}