script account sqlsrv & php check before registering

[gabrielresk]

Good day friends , I 'm programming a code for registering new accounts , the code below works for me perfectly , but only need to do, check if the account exists, if the account exists give me a warning, else proceed with the registration.

PROBLEM: account exists and the code recreates it without problems.
PROBLEM: I have a ERROR but I can't see it, please check the code and post solutions.


thanks, waiting for answers = )

<?php
$login = $_REQUEST["login"];
$pass = $_REQUEST["pass"];
$md5_key = '2001';
$endPw = $md5_key . $pass;
$md5 = md5($endPw);

$serverName = "localhost";   
$uid = "sa";     
$pwd = "BLABLABLA";    
$databaseName = "auth";   
$connectionInfo = array( "UID"=>$uid, "PWD"=>$pwd, "Database"=>$databaseName);   
?>

<?php
require_once('includes/connection.php'); 


/* Connect using SQL Server Authentication. */ 
$conn = sqlsrv_connect( $serverName, $connectionInfo);  

  
                        //Check if account exists
$accountExists =  sqlsrv_num_rows(sqlsrv_query( $conn, "select login_name from dbo.Accounts where  login_name='$_POST[login]'"));
if($accountExists > 0) echo "This account already exists<br/>";
else
{

$tsql = "insert into dbo.Accounts (login_name, password, block, withdraw_remain_time, age, auth_ok, pcbang, last_login_server_idx, referral_id, referral_code, server_list_mask) values ('$login','$md5','0','0','18','1','0','1','0','0','0')"; 
$stmt = sqlsrv_query( $conn, $tsql);if($stmt)
{
echo "Your account has been created<br />";
}
else
{
echo "An error has been occurred!<br />";
die( print_r( sqlsrv_errors(), true));
}
// Release resources.
sqlsrv_free_stmt($stmt);
sqlsrv_close($conn);
}



?>

 

[Future]

re: script account sqlsrv & php check before registering

PROBLEM: account exists and the code recreates it without problems.

Then first of all your database design is very questionable. An account name should always have a unique index.
I'm not too familiar with php but I don't know if sqlsrv_num_rows really returns the value you expect (try printing it).

A query that makes more sense for your account duplication check would be:

SELECT COUNT(*) FROM dbo.Accounts WHERE login_name='YOUR PARSED LOGIN NAME VARIABLE'

This would return an integral result of how many accounts exists, having that name (0 or 1 if your database model is setup properly). So you could check the result with

[...]
$resultVar = phpFunctionToExecTheQueryAbove();
if ($resultVar == 1)
{
   echo 'That user exists already!';
   return;
}
[...]

PROBLEM: I have a ERROR but I can't see it, please check the code and post solutions.

Oh I have errors too, nice to see I'm not alone
Come on... Are you going to tell us which errors you have or not?

You have another problem btw.
What you're doing here is a very bad idea:

$accountExists =  sqlsrv_num_rows(sqlsrv_query( $conn, "select login_name from dbo.Accounts where  login_name='$_POST[login]'"));

This is an easy task to accomplish for every kiddie SQL injection "hacker". Please consider using prepared statements or alternatively add some validation against SQL injections on the variable content of $_POST[login].