Convert registration form from mysql to mysqli

Question

This is my registration form in mysql and i'm trying to convert it to mysqli so that it would work with the data base

<?php
    mysql_connect("localhost","root","");  

    mysql_select_db("Project"); 

    if(isset($_POST['submit'])){ 
      $FirstName =$_POST['FirstName'];  
      $LastName = $_POST['LastName'];  
      $DOB = $_POST['DOB'];  
      $UserName = $_POST['UserName'];  
      $PassWord = $_POST['PassWord'];  
      $Email = $_POST['Email'];  
      $CourseID = $_POST['CourseID']; 

    if($FirstName==''){ 
        echo "<script>alert('please enter your  
        FirstName!')</script>"; 
        exit(); 
    } 
    if($LastName==''){ 
        echo "<script>alert('please enter your  
        LastName!')</script>"; 
        exit(); 
    } 
    if($DOB==''){ 
        echo "<script>alert('please enter your  
        DOB!')</script>"; 
        exit(); 
    } 
    if($UserName==''){ 
        echo "<script>alert('please enter your  
        UserName!')</script>"; 
        exit(); 
    } 
    if($PassWord==''){ 
        echo "<script>alert('please enter your  
        PassWord!')</script>"; 
        exit(); 
    } 

    if($CourseID==''){ 
        echo "<script>alert('please enter your  
        CourseID!')</script>"; 

        exit(); 
    } 
    if($Email==''){ 
        echo "<script>alert('please enter your  
        Email!')</script>"; 
        exit(); 
    } 
    $check_email = "select * FROM Student WHERE Email='$Email'"; 

    $run = mysql_query($check_email); 

    if(mysql_num_rows($run)>0){ 
       echo "<script> alert('email $Email already exist in our database, 
       please try another one')</script>"; 
       exit();            
    } 
    $query = "insert into Student (FirstName,LastName,DOB,UserName, 
    PassWord,Email,CourseID) VALUES('$FirstName','$LastName','$DOB', 
    '$UserName','$PassWord','$Email','$CourseID')"; 
    if(mysql_query($query)){ 

        echo "<script> window.open('Welcome.php','_self')</script>"; 
    } 
}
?>

If you're trying the important thing to answer is **what have you tried**. It's good you're switching, but the problem here is not clear. Most `mysqli` calls are very similar, but one thing to pay particular attention to is using **prepared statements**. — tadman, Apr 29 '16 at 06:49
in addition to what @tadman said, there is the [php manual that have examples for the functions you need to convert from mysql to mysqli...](http://php.net/manual/en/book.mysqli.php) Aside from the fact you did not seem to even try to search your issue around... [How could I change this mysql to mysqli?](http://stackoverflow.com/questions/1390607/how-could-i-change-this-mysql-to-mysqli) — Prix, Apr 29 '16 at 07:04
There's a whole section in the documentation on this, especially about [using prepared statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). — tadman, Apr 29 '16 at 07:08

Sanzeeb Aryal · Answer 1 · 2016-04-29T14:25:38.557

Change wherever necessary. This is OOP approach. Also donot store plain password.

$db = new mysqli("localhost", "root", "","db_name");
$check_email = $db->prepare("select * FROM Student WHERE Email=?"); 
$check_email->bind_param("s",$email);
$check_email->execute();
$result=$check_email->get_result();
$row=$result->fetch_assoc();

       if($row)
{
               echo "<script> alert('email $Email already exist in our database, 
               please try another one')</script>"; 
               exit();            
 } 
            $query = $db->prepare("insert into Student (FirstName,LastName,DOB,UserName, 
            PassWord,Email,CourseID) VALUES(?,?,?,?,?,?,?)"; 

            $query->bind_param("sssssss",$firstname,$lastname,$dob,$username,$password,$email,$courseid);          

if($query->execute())
{ 

                echo "<script> window.open('Welcome.php','_self')</script>"; 
            }

Wish I could give you more credit for recommending the OOP style. That makes mistakes a lot harder. Watch you don't quote values, like on line 3 here. — tadman, Apr 29 '16 at 07:08
`$db->prepare("select * FROM Student WHERE Email='?'")` is wrong. You're quoting the placeholder. — andrewsi, Apr 29 '16 at 13:27

Convert registration form from mysql to mysqli

1 Answers1