EDIT: Update! Got the first part working. However, I’m unsure how to also check for the other variables within the same IF() statement. Can anyone help me with that? The single if statement will refuse classes named exactly like the input. However, I need it to also refuse Days AND Times that are equal.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Register Diver</title>
<link rel="stylesheet" href="php_styles.css" type="text/css" />
<meta http-equiv="content-type"
content="text/html; charset=iso-8859-1" />
</head>
<body>
<h1>Aqua Don's Scuba School</h1>
<h2>Registration Confirmation</h2>
<?php
$DiverID = $_GET['diverID'];
if (empty($DiverID))
exit("<p>You must enter a diver ID! Click your browser's Back button to return to the previous page.</p>");
$DBConnect = @mysqli_connect("localhost", "students", "password")
Or die("<p>Unable to connect to the database server.</p>"
. "<p>Error code " . mysqli_connect_errno()
. ": " . mysqli_connect_error()) . "</p>";
$DBName = "scuba_school";
@mysqli_select_db($DBConnect, $DBName)
Or die("<p>Unable to select the database.</p>"
. "<p>Error code " . mysqli_errno($DBConnect)
. ": " . mysqli_error($DBConnect)) . "</p>";
$TableName = "registration";
$SQLstring = "SELECT * FROM $TableName";
$QueryResult = @mysqli_query($DBConnect, $SQLstring);
if (!$QueryResult) {
$SQLstring = "CREATE TABLE registration (diverID SMALLINT, class VARCHAR(40), days VARCHAR(40), time VARCHAR(40))";
$QueryResult = @mysqli_query($DBConnect, $SQLstring)
Or die("<p>Unable to create the registration table.</p>"
. "<p>Error code " . mysqli_errno($DBConnect)
. ": " . mysqli_error($DBConnect)) . "</p>";
echo "<p>Successfully created the registration table.</p>";
}
?>
<?php
$Class = $_GET['class'];
$Days = $_GET['days'];
$Time = $_GET['time'];
$DiverID = $_GET['diverID'];
$DBConnect = mysqli_connect("localhost", "students", "password");
$DBName = "scuba_school";
@mysqli_select_db($DBConnect, $DBName)
Or die("<p>Unable to select the database.</p>"
. "<p>Error code " . mysqli_errno($DBConnect)
. ": " . mysqli_error($DBConnect)) . "</p>";
$sqlString= "SELECT * FROM `registration` WHERE `diverID` = $DiverID AND `class` = '$Class' AND `days` = '$Days' AND `time` = '$Time'";
$QueryResult = mysqli_query($DBConnect, $sqlString) or die("MySQL error: " . mysqli_error($DBConnect) . "<hr>\nQuery: $QueryResult");
$row = mysqli_fetch_assoc($QueryResult);
if ($row["class"] == $Class)
{
echo "<p>You are already registered for $Class</p>";
}
elseif($row["days"] == $Days && $row["time"] == $Time)
{
echo "<p>There is a conflict with $Days or $Time</p>";
}
else
{
$SQLstring = "INSERT INTO $TableName VALUES('$DiverID', '$Class', '$Days', '$Time')";
$QueryResult = @mysqli_query($DBConnect, $SQLstring);
echo "<p>You are registered for $Class on $Days, $Time. Click your browser's Back button to register for another course or review your schedule.</p>";
}
mysqli_close($DBConnect);
?>
</body>
</html>
Use a query that says “find everyone with these details” then you say “if that found anyone = bad, else = good. For example:
Then you run that query, if it found anything (
if(count($results) > 0)...) then you show an error (or whatever) if it found nobody then it is safe to add the details.Bonus:
As a side note, please look into PDO (
mysql_*functions are no longer supported in PHP-land) and make sure you filter and sanitise your inputs before they go into Database queries (google for that,)