Checking Database validation

[Cyberspace]

I need to check a database for existing values, I have a form that users enter a MemberRef and Password. I am selecting a table called "walkers" with stores the following fields WalkNo and MemberRef, im trying to get the code to check if a user is already on this walk and if they are output an error. Can anyone please help, ive spent a while trying to get this to work and no joy.The last query in the code is where im having difficultly.

 

My full code is:

 

<?php

$WalkNo = $_GET['WalkNo'];


if (isset($_POST['submit'])) {  

$error_stat = 0;  
    $MemberRef_message = ''; 
    $Password_message = '';
    $Password2_message = '';
    $User_message = '';
    $Walk_message = '';

    $MemberRef = mysql_real_escape_string(stripslashes($_POST['MemberRef']));
    $Password = mysql_real_escape_string(stripslashes($_POST['Password']));
    
//Error checking  

// MemberRef Check)  
if (!$MemberRef) { 
//Set the error_stat to 1, which means that an error has occurred 
    $error_stat = 1; 

//Set the message to tell the user to enter a username 
    $MemberRef_message = '*Please enter MemberRef*'; 
} 

else if (!ctype_digit($MemberRef)) {  
   $error_stat = 1;  
   $MemberRef_message .= '*MemberRef must be a number*';  
} 

if (!$Password) { 
//Set the error_stat to 1, which means that an error has occurred 
    $error_stat = 1; 

//Set the message to tell the user to enter a username 
    $Password_message = '*Please enter a Password*'; 

}
    

if (isset($_POST['submit'])) {   

     $error_stat = 0;   
    $MemberRef_message = '';  
    $Password_message = ''; 
    $Password2_message = ''; 
    $User_message = ''; 
    $Walk_message = ''; 

    $MemberRef = mysql_real_escape_string(stripslashes($_POST['MemberRef'])); 
    $Password = mysql_real_escape_string(stripslashes($_POST['Password'])); 
     
//Error checking   

// MemberRef Check)   
if (!$MemberRef) {  
//Set the error_stat to 1, which means that an error has occurred  
    $error_stat = 1;  

//Set the message to tell the user to enter a username  
    $MemberRef_message = '*Please enter MemberRef*';  
}  

else if (!ctype_digit($MemberRef)) {   
   $error_stat = 1;   
   $MemberRef_message .= '*MemberRef must be a number*';   
}  

if (!$Password) {  
//Set the error_stat to 1, which means that an error has occurred  
    $error_stat = 1;  

//Set the message to tell the user to enter a username  
    $Password_message = '*Please enter a Password*';  

} 
     

if (isset($_POST['submit']) && $error_stat == 0) {  

$account = mysql_query("SELECT * FROM members WHERE MemberRef='$MemberRef' AND  Password='$Password'");
$numrows = mysql_num_rows($account); //get rows returned

if(mysql_num_rows($account) == 0){ 
         $error_stat = 1; 
//Set the message to tell the user MemberRef does not exist  
    $User_message = '*MemberRef or Password incorrect*'; 
     
}

else if ($numrows < 1)// if more than 0 its in database, if not throw new error message
{ 
$row = mysql_fetch_assoc($result);
$dbpassword = $row['Password']; //get the password from the database
if ($dbpassword != $Password) { // check it agains the inputted password, if not the same

    $error_stat = 1; 

//Set the message to tell the user to enter a username 
    $Password2_message = '*Incorrect Password*'; 

}

if (isset($_POST['submit']) && $error_stat == 0) { 
$account = mysql_query("SELECT * FROM walkers WHERE MemberRef='$MemberRef' AND WalkNo='$WalkNo'");

if ($numrows > 1){ 

    $error_stat = 1; 

//Set the message to tell the user to enter a username 
    $Walk_message = '*User already on walk*'; 
     
}
}
}

}
}
}
}


?>






<hr class="hr_blue"/></p><font face="Arial" size="3">Join Walk</font><form method="post" class="addwalkerform" action="">   
</font>
<fieldset>
<label for="MemberRef">MemberRef:</label>  
<input name="MemberRef" type="text" id="MemberRef" value="<?php echo $_POST['MemberRef']; ?>"/> 
<span class="redboldtxt"><?php echo "$MemberRef_message";?></fieldset></span>  
</fieldset>

<fieldset>
<label for="Password">Password:</label>  
<input name="Password" type="text" id="Password" value="<?php echo $_POST['Password']; ?>"/> 
<span class="redboldtxt"><?php echo "$Password_message";?></fieldset></span>
<span class="redboldtxt"><?php echo "$Password2_message";?></fieldset></span>

<fieldset> 
<p class="submit"><input type="submit" name="submit" value="Join Walk" />

<span class="redboldtxt"><?php echo "$User_message";?></fieldset></span>

<span class="redboldtxt"><?php echo "$Walk_message";?></fieldset></span>


</fieldset>


</fieldset>
<p> </p>
<p> </p>
</form>

 

 

[darkfreaks]

make sure you have error checking

 

<?php

$account = mysql_query("SELECT * FROM walkers WHERE MemberRef='$MemberRef' AND WalkNo='$WalkNo'") or die(mysql_error());?>