It's my first post on stackoverflow and I prevent you I don't speak English very well but i can try to be clear on my problem :)
I have a registration form in PHP and i have two Statements :
First Statement : Searching into my table "users" if there's not another pseudo / email for example.
$request = $db->prepare("SELECT * FROM users WHERE USE_USERNAME = :username AND USE_EMAIL = :email AND USE_PASSWORD = :password");
$request->bindParam(':username', $username, PDO::PARAM_STR);
$request->bindParam(':email', $email, PDO::PARAM_STR);
$request->bindParam(':password', $password, PDO::PARAM_STR);
$request->execute();
var_dump($request);
while ($row = $request->fetchAll(PDO::FETCH_ASSOC)){
if ($username == $row['USE_USERNAME']){ ...
Second Statement : If the user enters good datas, i can insert inputs into my database.
$request = $db->prepare("INSERT INTO users (USE_USERNAME, USE_EMAIL, USE_PASSWORD) VALUES (:username, :email, :password)");
$request->bindParam(':username', $username, PDO::PARAM_STR);
$request->bindParam(':email', $email, PDO::PARAM_STR);
$request->bindParam(':password', $pass_hache, PDO::PARAM_STR);
$request->execute();
My problem :
When i insert 'OR 1=1' in an input, i can insert the same e-mail address in the database.
I searched in this website a solution and i added those lines to my database connection :
$db->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
But my datas insert even i put error messages in my PHP code (with Javascript popups in my while loop).
I am a beginner, i'm searching to Similar questions, but thank you for your help if you have an answer :)
Have a nice day :)
Edit : I will explain you when I manage errors in PHP :
while ($row = $request->fetchAll(PDO::FETCH_ASSOC)){
if ($username == $row['USE_USERNAME']){
?>
<script type="text/javascript">
alert("Erreur#5 : Pseudonyme Faux !"); //Cas dans lequel les identifiants sont incorrects.
document.location.href="subscribe.php";
</script>
<?php
$error++;
It's very banal, but i have a variable $error that begins at 0, and I increment it in order to stop the PHP script.
There's errors for an unique Username and email. Before my prepare statements, my errors worked, but now I want prevent my form from SQL Injections.