My database is not adding users when I signup

Question

This is my HTML file:

 <div class="form">
            <form action="register.php" method="POST" class="register-form">
            <input type="text" placeholder="Username" name="username" required/>
            <input type="password" placeholder="Password" name="password" required/>
            <input type="text" placeholder="Email" name="email"  required/>
            <button type="submit">Create</button>
            <p class="message"> Already Registered? <a href="#">Login</a>
            </p>
            </form>
    
            <form action="login.php" method="POST" class="login-form">
            <input type="text" placeholder="Username" name="username" required/>
            <input type="password" placeholder="Password" name="password" required/>
            <button type="submit">login</button>
            <p class="message">Not Registered? <a href="#">Register</a></p>
            </form>

This is my PHP file:

$username = $_POST['username'];
$password = $_POST['password'];
$email = $_POST['email'];

if (!empty($username) || !empty($password) || !empty($email)) {
 $serverName = "localhost";
    $dbUsername = "root";
    $dbPassword = "";
    $dbname = "account";

    //create connection
    $conn = new MySQLI($serverName,$dbUsername,$dbPassword,$dbname);
    if (mysqli_connect_error()) {
     die('Connect Error('. mysqli_connect_errno().')'. mysqli_connect_error());
    } else {
     $SELECT = "SELECT email From users Where email = ? Limit 1";
     $INSERT = "INSERT Into users (username, password, email) values(?, ?, ?)";

     //Prepare statement
     $stmt = $conn->prepare($SELECT);
     $stmt->bind_param("s", $email);
     $stmt->execute();
     $stmt->bind_result($email);
     $stmt->store_result();
     $stmt->store_result();
     $stmt->fetch();
     $rnum = $stmt->num_rows;
     if ($rnum==0) {
      $stmt->close();
      $stmt = $conn->prepare($INSERT);
      $stmt->bind_param("sss", $username, $password, $email);
      $stmt->execute();
      echo "New record inserted sucessfully";
     } else {
      echo "Someone already register using this email";
     }
     $stmt->close();
     $conn->close();
    }
} else {
 echo "All field are required";
 die();
}

I have a database called account, with a table called users, columns called id, email, username & password. The ID is an INT, and selected as primary. And the rest is set as VARCHAR.

When I enter some names in the form, and press signup, it's giving me the result "New record inserted successfully", so I have no idea, why this doesn't work.

Answer 1

Your problem is the way you use mysqli. As I have said in the comments mysqli is not suitable for beginners, the API is very cumbersome.

Look at the lines before your INSERT statement. You perform a SELECT statement, presumably to check if the email has been used before and then you bind the result variable. The variable is called $email. You overwrite your user input with the result from SELECT. But this is not the right way.

The simple solution would be to name the variable something else, but the right answer is that you should fetch a count from the SQL not the value. See adjusted code below:

<?php

$username = filter_input(INPUT_POST, 'username');
$password = filter_input(INPUT_POST, 'password');
$email = filter_input(INPUT_POST, 'email');

if ($username && $password && $email) {
    $serverName = "localhost";
    $dbUsername = "root";
    $dbPassword = "";
    $dbname = "account";

    //create connection
    mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
    $conn = new MySQLI($serverName, $dbUsername, $dbPassword, $dbname);
    $conn->set_charset('utf8mb4'); // always set the charset

    //Prepare statement
    $stmt = $conn->prepare("SELECT COUNT(email) From users Where email = ? Limit 1");
    $stmt->bind_param("s", $email);
    $stmt->execute();
    $stmt->store_result();
    $stmt->bind_result($exists); // we fetch the count
    $stmt->fetch();
    if (!$exists) {
        $stmt = $conn->prepare("INSERT Into users (username, password, email) values(?, ?, ?)");
        // Don't forget to hash the password and never store the real password anywhere
        $hash = password_hash($password, PASSWORD_DEFAULT);
        $stmt->bind_param("sss", $username, $hash, $email);
        $stmt->execute();
        echo "New record inserted sucessfully";
    } else {
        echo "Someone already register using this email";
    }
} else {
    echo "All field are required";
}

I remove the unnecessary code and removed the store_result() and num_rows. They are not helpful in this situation. Instead fetch a count of matching rows and check if the count is not 0 with if(!$exists)