Question

I’m trying to write a User Login System for my website. I’m running WAMP on my laptop and using Aptana for development. I’ve been stuck trying to get a User Creation function to work for about 3 days now. This function here:

function create_new_user($email, $pass, $level){
$db = new PDO('mysql:host=localhost;dbname=jadams', 'root', '');
$insertQuery = "INSERT INTO jadams.user VALUES ($email, $pass, $level);";
$db->query($insertQuery);
return TRUE;
}

I have rewritten this function several times, using prepared statements and various forms of conditional checks, this is just the simplest one in the hopes of figuring it out. No matter what I try I cannot get the insertion into the database to work. I have gotten this login function working by forcibly inserting users through phpMyAdmin:

function is_pass_correct($email, $pass){
$db = new PDO('mysql:host=localhost;dbname=jadams', 'root', '');
$email = $db->quote($email);
$selectQuery = "SELECT password FROM jadams.user WHERE email = $email;";
$rows = $db->query($selectQuery);
$db=NULL;
if($rows) {
    foreach ($rows as $row) {
        if($pass === $row["password"]) {return TRUE;}   //MD5
    }
}
return FALSE;
}

The structure of my Database is email varchar(256) not null primary, password varchar(256) not null, access int; I have also tried the query with and without a semicolon.

Answer 1

You’re missing the column names in which to insert the values.

"INSERT INTO jadams.user (email, password, level) VALUES ($email, $pass, $level);"

Also, since you’re using the PDO library consider using prepared statements to escape untrusted data.

$insertQuery = "INSERT INTO jadams.user (email, password, level) 
                VALUES (:email, :password, :level)";
$db = $conn->prepare($insertQuery);
$db->execute(array(':email'=>$email,
                   ':password'=>$pass,
                    ':level'=>$level));