250np$ For simple php script

[QBert]

Hey, i need a script that checkes a value what somones typed up to see if its = to somthing in the database. just like checking for a username to put to a password.

Thanks

QBert

 

[Crusader]

This would be form.html

<form name="checker" method="POST" action="domain.com/check.php">
  <p>Username: <input type="text" name="username" size="20" value="<?php echo $username; ?>"><br>
  <input type="submit" value="Check" name="doit"></p>
</form>

This would be check.php

<?php

$username = $_POST['username'];

if($username != " "){
	$username = str_replace("<?", " ", $username);
	$username = str_replace("?>", " ", $username);
	
	$sql_username_check = mysql_query("SELECT username FROM usernames WHERE username='$username'");
	$username_check = mysql_num_rows($sql_username_check);

 	if($username_check > 0){
 		echo "That username already exists.";
 		unset($username);
 	} else {
		echo "That username does not exist.";
	}
}

include ("form.html");

?>

I think that should work. Note you'd need a table called usernames with a field called username.

 

[PolurNET]

remember to connect to a DB first m8, you need to use

mysql_connect('localhost', 'mydb', 'mypass');

 

[peaudecastor]

Hi Crusader,

Why are you checking for <? and ?> ?

$username = str_replace("<?", " ", $username);

Unless you prove me otherwise they are harmless what you should always do to be secure are :
$username = addslashes($username);

With your code I could post in the username field something like '; DELETE FROM usernames

And break you

Matt

This would be form.html

<form name="checker" method="POST" action="domain.com/check.php">
  <p>Username: <input type="text" name="username" size="20" value="<?php echo $username; ?>"><br>
  <input type="submit" value="Check" name="doit"></p>
</form>

This would be check.php

<?php

$username = $_POST['username'];

if($username != " "){
	$username = str_replace("<?", " ", $username);
	$username = str_replace("?>", " ", $username);
	
	$sql_username_check = mysql_query("SELECT username FROM usernames WHERE username='$username'");
	$username_check = mysql_num_rows($sql_username_check);

 	if($username_check > 0){
 		echo "That username already exists.";
 		unset($username);
 	} else {
		echo "That username does not exist.";
	}
}

include ("form.html");

?>

I think that should work. Note you'd need a table called usernames with a field called username.

 

[Crusader]

Err. Yeah, you're right. Ignore the <? ?> and strip out special characters instead.

 

[QBert]

Thanks everyone,

NP$'s sent Crusader. Thanks!