检查电子邮件是否已经存在[重复]

Question

如何检查邮箱是否已经存在于数据库中并拒绝注册？

MySQL 是教给我的，我目前正在使用 MySQLi。

这是我目前正在使用 MySQLi 编写的代码：

<?php 
$cookie_name = "loggedin";

$servername = "localhost";
$username = "root";
$password = "";
$database = "scholarcaps";
$conn = mysqli_connect($servername, $username, $password, $database);

if (!$conn) {
    die("Database connection failed: ".mysqli_connect_error());
}

if (isset($_POST['login']))
{
    $user = $_POST['username'];
    $pass = $_POST['password'];

    $phash = sha1(sha1($pass."salt")."salt");

    $sql = "SELECT * FROM users WHERE username='$user' AND password='$phash';";

    $result = mysqli_query($conn, $sql);
    $count = mysqli_num_rows($result);

    if ($count == 1)
    {
        $cookie_value = $user;
        setcookie($cookie_name, $cookie_value, time() + (180), "/");
        header("Location: personal.php");
    }
    else
    {
        echo "Username or password is incorrect!";
    }
}
else if (isset($_POST['register']))
{
    $user = $_POST['username'];
    $email = $_POST['email'];
    $pass = $_POST['password'];

    $phash = sha1(sha1($pass."salt")."salt");

    $sql = "INSERT INTO users (id, email, username, password) VALUES ('','$email', '$user', '$phash');";

    $result = mysqli_query($conn, $sql);
}
?>

Answer 1

尽管使用mysqli，您的代码仍然容易受到 sql 注入的影响，因为您直接在 sql 语句中嵌入变量 - 使用准备好的语句来避免令人讨厌的意外。以下内容未经测试，但应显示如何使用准备好的语句。有更好的密码散列方法 - 例如 password_hash 和 password_verify 虽然这些在 5.5 之前的 PHP 版本中不可用

$response=array();
$cookie_name='loggedin';


$dbhost =   'localhost';
$dbuser =   'root'; 
$dbpwd  =   ''; 
$dbname =   'scholarcaps';
$db =   new mysqli( $dbhost, $dbuser, $dbpwd, $dbname );




if( isset( $_POST['login'] ) ) {

    $user  = $_POST['username'];
    $pass  = $_POST['password'];
    $phash = sha1( sha1( $pass . "salt" ) . "salt" );

    $sql='select `username`, `password` from `users` where `username`=? and `password`=?';
    $stmt=$db->prepare( $sql );

    if( $stmt ){

        $stmt->bind_param( 'ss', $username, $phash );
        $result=$stmt->execute();

        if( !$result ) $response[]='Query failed';


        $stmt->store_result();
        $stmt->bind_result( $name, $pwd );
        $stmt->fetch();

        if( $stmt->num_rows()==0 ) $response[]='No such user';
        else {

            $stmt->free_result();
            $stmt->close();
            $db->close();

            setcookie( $cookie_name, $user, time() + 180, "/" );
            exit( header( "Location: personal.php" ) );
        }


        $stmt->free_result();
        $stmt->close();
        $db->close();

        /* show errors */
        if( !empty( $response ) ){
            echo '<ul><li>',implode('</li><li>',$response),'</li></ul>';
        }
    }

} elseif( $_POST['register'] ){

    $user = $_POST['username'];
    $email = $_POST['email'];
    $pass = $_POST['password'];
    $phash = sha1( sha1( $pass . "salt" ) . "salt" );



    /* Does the email address already exist? */

    $emailfound=false;

    $sql='select `email` from `users` where `email`=?';
    $stmt=$db->prepare( $sql );
    if( $stmt ){

        $stmt->bind_param('s',$email);
        $result=$stmt->execute();
        if( $result ){
            $stmt->store_result();
            $stmt->bind_result( $emailfound );
            $stmt->fetch();
            $stmt->free_result();
        }
    }

    if( $emailfound ){
        echo 'Sorry, that email address already exists in our database. Please try again with a different address.';
        $stmt->close();
        $db->close();

    } else {

        /* the `id` should be automatically generated I assume - hence being omitted here */
        $sql='insert into `users` (`email`, `username`, `password`) values (?,?,?);';
        $stmt=$db->prepare( $sql );

        if( $stmt ){

            $stmt->bind_param( 'sss', $email, $username, $phash );
            $result=$stmt->execute();

            $stmt->free_result();
            $stmt->close();
            $db->close();

            if( $result ) header('Location: login.php');
            else{
                /* failed to register the user */
            }
        }
    }
}

Answer 2

我通过使用唯一属性设置我的电子邮件列解决了这个问题。注册提交后，您可以赶上mysqli_errno()。所以你会看到是否有重复的条目。

您将使用此解决方案保存检查查询。

Answer 3

如果您不想匹配电子邮件，只想确保电子邮件地址存在，您可以...

$sql = "SELECT * FROM users WHERE username='$user' AND password='$phash' AND email<>'';";

或者，指定最小长度...

$sql = "SELECT * FROM users WHERE username='$user' AND password='$phash' AND LEN(email) > 0;";

Answer 4

使用这个php函数来获取数据库中的记录数

$count=mysqli_num_rows($result)

检查后是否大于0

Answer 5

试试这个， 在sha1之后添加这段代码

$result = mysql_query("select COUNT(id)  from users where email='".$email."'");
$count = mysqli_num_rows($result);
if($count > 0){
    echo "email exist";
}else
{
    $sql = "INSERT INTO users (id, email, username, password) VALUES ('','$email', '$user', '$phash');";
    $result = mysqli_query($conn, $sql);
}