PHP register form will tell user that an email already exists in the database when it doesn't

Question

I have a PHP form on one page and the form action in a separate php file. I am getting feedback from users saying that when they try and register, some users, not all, because I can see some user's info updated in my database, some users get the error message letting them know that the email they are trying to register with is already in the database, and when they try and log in on my login page (which only requires a registered email address) it tells them that it does not exist in the database. So I think something is wrong with my register form or the action code.

Here is the form action php code:

<?php
include("includes/connection.php");


$sql = "INSERT INTO login (email, first_name, last_name, business_name, occupation, business_address_1, business_address_2, country, city, state_province, zip, phone, business_address_1_alt, business_address_2_alt, country_alt, city_alt, state_province_alt, zip_alt, phone_alt, special_offers)
VALUES ('$_POST[email]','$_POST[first_name]','$_POST[last_name]','$_POST[business_name]','$_POST[occupation]','$_POST[business_address_1]','$_POST[business_address_2]','$_POST[country]','$_POST[city]','$_POST[state_province]','$_POST[zip]','$_POST[phone]','$_POST[business_address_1_alt]','$_POST[business_address_2_alt]','$_POST[country_alt]','$_POST[city_alt]','$_POST[state_province_alt]','$_POST[zip_alt]','$_POST[phone_alt]','$_POST[special_offers]')";


if (mysqli_query($connection, $sql)) {
echo header('Location: reg-success.php');
} else {
 mysqli_error($connection);
}
//Check for Duplicate Email

if (mysqli_error($connection).("Duplicate entry '$email' for key 'email'")) {
echo "<div style='margin: auto 0; text-align:center;'><p>&nbsp;</p><p>&nbsp;</p><p>&nbsp;</p>Email already exists ... please try again.<br><br><a href='register.php'>Click here to return to the register page.</a></div>";
//header('Location: register.php');
exit;

//trigger_error('Email Already Exists.', E_USER_WARNING);
}



mysqli_close($connection);

?>

And here is the code from the page the php form resides on:

<?php
// Start the session
session_start();
?>
<!doctype html>
<html>
<head>
<!-- Necessary jQuery Code (if you are using the $.browser object you need jQuery < 1.9) -->
<script src="http://code.jquery.com/jquery-1.8.3.min.js"></script>
<!-- Your scripts-->
<script type='text/javascript'>
var form = document.getElementById('register'); // form has to have ID: <form id="formID">
form.noValidate = true;
form.addEventListener('submit', function(event) { // listen for form submitting
    if (!event.target.checkValidity()) {
        event.preventDefault(); // dismiss the default functionality
        alert('Please, fill the form'); // error message
    }
 }, false);
</script>

<link rel="stylesheet" type="text/css" href="global.css">
<link href='http://fonts.googleapis.com/css?family=Anton' rel='stylesheet' type='text/css'>
<meta charset="UTF-8">
<title>Install Fel-Pro Promotion</title>
</head>

<body>

<div class="wrapper">

<form id="register" name="register" action="register-form.php" method="POST" accept-charset="utf-8"><table width="600px">
<tr>
<td style="padding-right:14px;" valign="top"><span id="large-copy-2b">REGISTER:</span></td>
<td style="padding-right:14px;" valign="top"><input type="email" id="email" name="email" required = "true" = "true"></td>
<td>Email Address<span style="color:#FF0004;">*</span></td></tr>

<tr>
<td height="14px" colspan="3"><span id="large-copy-2b" style="color:#FF0004; font-size:14px;">required*</span></td></tr>

<tr><td ></td><td style="padding-right:14px;" valign="top"><input type="text" id="first_name" name="first_name" required = "true"></td>
<td>First Name<span style="color:#FF0004;">*</span></td></tr>
<td height="14px" colspan="3"></td></tr>
<tr><td></td><td><input type="text" id="last_name" name="last_name" required = "true"></td>
<td>Last Name<span style="color:#FF0004;">*</span></td></tr>
<td height="14px" colspan="3"></td></tr>
<tr><td></td><td style="padding-right:14px;" valign="top"><input type="text" id="business_name" name="business_name" required = "true"></td>
<td style="padding-right:14px;" valign="top">Business Name<span style="color:#FF0004;">*</span></td></tr><td height="14px" colspan="3"></td></tr>
<tr><td></td><td style="padding-right:14px;" valign="top"><input type="text" id="occupation" name="occupation" required = "true"></td>
<td style="padding-right:14px;" valign="top">Occupation<span style="color:#FF0004;">*</span></td></tr><td height="14px" colspan="3"></td></tr>
<tr><td></td><td style="padding-right:14px;" valign="top"><input type="text" id="business_address_1" name="business_address_1" required = "true"></td>
<td style="padding-right:14px;" valign="top">Business Address 1<span style="color:#FF0004;">*</span></td></tr><td height="14px" colspan="3"></td></tr>
<tr><td></td><td style="padding-right:14px;" valign="top"><input type="text" id="business_address_2" name="business_address_2"></td><td style="padding-right:14px;" valign="top">Business Address 2</td></tr><td height="14px" colspan="3"></td></tr>
<tr><td></td><td style="padding-right:14px;" valign="top"><select name="country">
<option>United States</option>
<option>Canada</option>

</select></td>
<td style="padding-right:14px;" valign="top">Country<span style="color:#FF0004;">*</span></td></tr><td height="14px" colspan="3"></td></tr>
<tr><td></td><td style="padding-right:14px;" valign="top"><input type="text" id="city" name="city" required = "true"></td>
<td style="padding-right:14px;" valign="top">City<span style="color:#FF0004;">*</span></td></tr><td height="14px" colspan="3"></td></tr>
<tr><td></td><td style="padding-right:14px;" valign="top"><select name="state_province">
<option>*states*</option>

</select></td>
<td style="padding-right:14px;" valign="top">State/Province<span style="color:#FF0004;">*</span></td></tr><td height="14px" colspan="3"></td></tr>
<tr><td></td><td style="padding-right:14px;" valign="top"><input type="text" id="zip" name="zip" required = "true"></td>
<td style="padding-right:14px;" valign="top">ZIP/Postal Code<span style="color:#FF0004;">*</span></td></tr><td height="14px" colspan="3"></td></tr>
<tr><td></td><td style="padding-right:14px;" valign="top"><input type="text" id="phone" name="phone" required = "true"></td>
<td style="padding-right:14px;" valign="top">Phone<span style="color:#FF0004;">*</span></td></tr><td height="42px" colspan="3" align="center"><span id="large-copy-2b">SHIPPING ADDRESS (IF DIFFERENT)</span></td></tr>


<tr><td></td><td style="padding-right:14px;" valign="top"><input type="text" id="business_address_1_alt" name="business_address_1_alt"></td><td style="padding-right:14px;" valign="top"> Address 1</td></tr><td height="14px" colspan="3"></td></tr>
<tr><td></td><td style="padding-right:14px;" valign="top"><input type="text" id="business_address_2_alt" name="business_address_2_alt"></td><td style="padding-right:14px;" valign="top">Address 2</td></tr><td height="14px" colspan="3"></td></tr>
<tr><td></td><td style="padding-right:14px;" valign="top"><select name="country_alt">
  <option value=""></option>
  <option>United States</option>
  <option>Canada</option>

</select></td><td style="padding-right:14px;" valign="top">Country</td></tr><td height="14px" colspan="3"></td></tr>
<tr><td></td><td style="padding-right:14px;" valign="top"><input type="text" id="city_alt" name="city_alt"></td><td style="padding-right:14px;" valign="top">City</td></tr><td height="14px" colspan="3"></td></tr>
<tr><td></td><td style="padding-right:14px;" valign="top"><select name="state_province_alt">
<option>*states*</option>

</select></td><td style="padding-right:14px;" valign="top">State/Province</td></tr><td height="14px" colspan="3"></td></tr>
<tr><td></td><td style="padding-right:14px;" valign="top"><input type="text" id="zip_alt" name="zip_alt"></td><td style="padding-right:14px;" valign="top">ZIP/Postal Code</td></tr><td height="14px" colspan="3"></td></tr>
<tr><td></td><td style="padding-right:14px;" valign="top"><input type="text" id="phone_alt" name="phone_alt"></td><td style="padding-right:14px;" valign="top">Phone</td></tr><td height="14px" colspan="3"></td>



<tr><td></td><td style="padding-right:14px;" valign="top"><select name="special_offers">
<option>Yes</option>
<option>No</option>

</select></td><td style="padding-right:14px;" valign="top">Would you like to receive email with special offers and programs?</td></tr><td height="14px" colspan="3"></td></tr>
<tr><td></td><td><input type="submit" src="_images/submit-btn.jpg" border="0"></td></tr></table>

</form>

</div>

*I removed all the state options so this post isn't super long.

`if (mysqli_error($connection).("Duplicate entry '$email' for key 'email'")) {` <-- totally borked — John Conde, Mar 09 '15 at 12:54
It's great that you're using a modern API like mysqli_, but now see prepared statements — Strawberry, Mar 09 '15 at 12:55
@Holodout See [bind_param](http://php.net/manual/en/mysqli-stmt.bind-param.php) and [how to prevent SQL injection](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — ʰᵈˑ, Mar 09 '15 at 13:01
Are you sure your insert query look exactly as you show? It should be rather `'{$_POST['email']}'` than `'$_POST[email]'` — n-dru, Mar 09 '15 at 13:02
In addition to whatˑhas been said,checking if there was an error is not the way to check if the email already exist,instead use a select statement to check this part and in case of `mysqli_error` throw an exception — Gal Sisso, Mar 09 '15 at 13:05
This is also invalid `echo header('Location: reg-success.php');` — Funk Forty Niner, Mar 09 '15 at 13:05
After the form gets posted, use the email id provided by the user to first fetch record, if no record is found it means that email id does not exist and only then run the insert query. Second thing is, you are directly adding the $_POST values in database which is very dangerous. Since you are already using mysqli, so use the mysqli prepared statement syntax. — Shairyar, Mar 09 '15 at 13:13

score 1 · Accepted Answer · answered Mar 09 '15 at 13:07

After you issue a header() statement you should then run an exit; or the code continues to execute normally.

So try

if (mysqli_query($connection, $sql)) {
    header('Location: reg-success.php');
    exit;
} else {
    mysqli_error($connection);
}

I cannot say I like this mechanism of duplicate checking, I would suggest it would be better to run a SELECT query to check those fields that should not be duplicated before running the INSERT.

The problem being there could be any number of errors that could occur, but you are only checking for one specific error.

OP also needs to `print` the `mysqli_error` as currently it just exists without its purpose being defined. After the print a `die/exit` statement should also be placed. — Martin, Mar 09 '15 at 13:20

PHP register form will tell user that an email already exists in the database when it doesn't

1 Answers1