update users email check if new email address exist expect for current email

[conan318]

i wanting users to be able to update there email address and check to see if the new email already exists. if the email is the same as current email ignore the check.

i have no errors showing up but if I enter a email already in the db it still accepts the new email instead of bringing the back the error message.

// email enterd from form //
$email=$_POST['email'];


$queryuser=mysql_query("SELECT * FROM members WHERE inv='$ivn' ") or die (mysql_error());
while($info = mysql_fetch_array( $queryuser )) {
	$check=$info['email'];
// gets current email //
}


if($check!=$email){
// if check not equal to $email check the new email address already exists//
$queryuser=mysql_query("SELECT * FROM members WHERE email='$email' ");
//$result=mysql_query($sql);
$checkuser=mysql_num_rows($queryuser);
if($checkuser != 0)
{ 
$error= "0";
header('LOCATION:../pages/myprofile.php?id='.$error.'');


}
}

 

cheers

[joel24]

try

if($checkuser !== 0)

 

also have you tried

exit($checkuser);

to see what is being returned?

[Psycho]

You are making this much harder than it needs to be. Here are a few comments before I provide some revised code:

 

1. Don't use multiple queries when only one is needed.

2. If a query should only return one result then you don't need a while() loop to get the result such as this

while($info = mysql_fetch_array( $queryuser ))
{
    $check=$info['email'];
// gets current email //
}

If there "were" multiple results you would only be left with the last value anyway.

 

3. You don't need to check if the submitted email is the same as the current user's. It makes no sense to do a select query to see if it matches and then do an update query. just run the update query once you verify that the email is not the same as another user's

 

4. Don't use '*' in your select queries if you don't need all the records. It is a waste of server resources - especially when you are only checking one field!

 

5. You are not sanitizing the user input and are open to SQL Injection attacks.

 

Sample code

//Preprocess email enterd from form
$email = mysql_real_escape_string(trim($_POST['email']));

//Query DB to see if any other users are using the email
$query = "SELECT email
          FROM members
          WHERE email = '$email'
          WHERE inv<>'$ivn'";
$result = mysql_query($query) or die(mysql_error());

if(mysql_num_rows($result))
{
    //There is another user with this email. Perform error handling
}
else
{
    //No other user is using this email. It is safe to update
}