Question

I am using this to compare the password entered and the confirm password. No matter what, it creates the user. Why so?

here’s the database code –

$connect = @mysql_connect ($host, $username, $password) or die ('error');
$select = @mysql_select_db($db_name, $connect) or die('check');
$username=stripslashes(trim($_POST['username']));
$select_record="select * from users where username=' ".$username."' ";
$select_query=mysql_query($select_record)  or die (mysql_error());
if(mysql_num_rows($select_query)==0)

{
    $fullname = stripslashes(trim($_POST['fullname']));
    $email = stripslashes(trim($_POST['email']));
    $website = stripslashes(trim($_POST['website']));
    $username = stripslashes(trim($_POST['username']));
    $password = stripslashes(trim($_POST['password']));
    $add_new="insert into users (fullname,email,website,username,password) values ('$fullname','$email','$website','$username','$password')";
    $add_query=mysql_query($add_new) or die(mysql_error());
    if($add_query)
    {
        echo "Awesome! You are now a member";
    }
}
else
echo "Please try again";
?>

Above connect, i have my database username and password.

Just to revise, here’s my current code –

<div id="form"><form action="registersuccess.php" method="post">
Full Name<br />
<input type="text" name="fullname"/>
<br /><br />
Website<br />
<input type="text" name="site"/><br /><br />
Email<br />
<input type="text" name="email"/><br /><br />
Username<br />
<input type="text" maxlength="255" name="username"/><br />
<br />
Password<br />
<input type="password" name="password"/><br />
<br />
Confirm Password<br />
<input type="password" name="confirmpass"/><br />
<br />
<p class="submit"><input type="submit" value="Create my Account"/></p>

</form>

<?php
$pass = $_POST['password']; 
$cpass = $_POST['confirmpass'];
$cmp = strcmp($pass, $cpass);

if ($cmp != 0)
{
    echo "check password";
}
else
{
    return true;
}
?>

Answer 1

A number of glaring syntax gotchas here. It appears that you’re not even seeing any notices/warnings (about undefined variables, undefined constants, etc), so you’d better edit php.ini to turn on error reporting (of at least E_NOTICE or so), or tack this in the beginning of your scripts:

error_reporting(E_ALL);

That’ll make syntax “errors” (meaning they’re not actual parse errors, but are still typing mistakes that are recognized by PHP to mean something else) much, much easier to catch, as PHP will print messages that tell you if there’s anything fishy with your code, and at which files/lines.

Now on to the actual issues with your code.

---

You need to assign the result of strcmp() to a variable then check that variable. Also, you can change the if condition to say $cmp != 0 since you’re testing for any kind of inequality, that is, you’re testing for is not 0.

$cmp = strcmp($pass, $cpass);

if ($cmp != 0)
...

In fact, by doing that you can completely bypass having to use a temporary variable, and just pass the result of the function call into the condition statement:

if (strcmp($pass, $cpass) != 0)

Or by directly comparing the strings instead of comparing the strcmp() result:

if ($pass != $cpass)

---

Additionally, as others point out, you got your POST value assignments wrong, they should be the other way around, otherwise you’re overwriting $_POST‘s values with nothing. You can also drop the parentheses ( ) for array keys as they’re not necessary at all:

$pass = $_POST['password']; 
$cpass = $_POST['confirmpass'];