验证错误！验证检查数据库 phpmyadmin 中是否已存在电子邮件地址

Question

如果邮箱地址已经存在于数据库中，那么程序不应该被执行并显示“邮箱已经注册”的错误，但它不是这样工作的。代码对我来说看起来不错，没有语法错误。但没有像我想要的那样工作，而不是向我展示存在电子邮件的错误。它执行表单并在 mysql 数据库中插入重复的电子邮件地址。

这是代码，如果有人可以提供帮助，请告诉我。

<?php
include('dbconnection.php');
if(isset($_REQUEST['rSignup'])){
    if(($_REQUEST['rName'] == "") || ($_REQUEST['rEmail'] =="") || ($_REQUEST['rPassword'] =="")){
        $regmsg = '<div class="alert alert-warning mt-2" role="alert">All Fields are Required</div>';
    }else{
        $sql = "SELECT r_email FROM requestorlogin_tb WHERE r_email='".$_REQUEST['rEmail']."'";
        $result = $conn->query($sql);
        if($result->num_rows==1){
            $regmsg = '<div class="alert alert-warning mt-2" role="alert">Email ID Already Registered</div>';
        } else{
            $rName = $_REQUEST['rName'];
            $rEmail = $_REQUEST['rEmail'];
            $rPassword = $_REQUEST['rPassword'];
            $sql = "INSERT INTO requesterlogin_tb(r_name,r_email,r_password) VALUES('$rName','$rEmail','$rPassword')";
            if($conn->query($sql) == TRUE){
                $regmsg = '<div class="alert alert-success mt-2" role="alert">Account Successfully Created</div>';
            } else{
                $regmsg = '<div class="alert alert-danger mt-2" role="alert">Unable to Create Account</div>';
                }
            }
    }
}

?>

Answer 1

请更新您的查询以防止 sql 注入并尝试：

  $remail=$_REQUEST['rEmail'];
   $stmt = $conn->prepare("SELECT r_email FROM requestorlogin_tb WHERE r_email=?");
    $stmt->bind_param('s', $remail);
    $stmt->execute();
    $result = $stmt->get_result(); // Assign the result to a variable

    if ($result->num_rows > 0) { // Check the number of rows in the MySQLi result object
        echo "exist";
        
        $stmt->close();
        $conn->close();
    } else {
    ....