Wrong email verification

Viewed 97

It's my first post on stackoverflow and I prevent you I don't speak English very well but i can try to be clear on my problem :)

I have a registration form in PHP and i have two Statements :

First Statement : Searching into my table "users" if there's not another pseudo / email for example.

$request = $db->prepare("SELECT * FROM users WHERE USE_USERNAME = :username AND USE_EMAIL = :email AND USE_PASSWORD = :password");
$request->bindParam(':username', $username, PDO::PARAM_STR);
$request->bindParam(':email', $email, PDO::PARAM_STR);
$request->bindParam(':password', $password, PDO::PARAM_STR);
$request->execute();
var_dump($request);
while ($row = $request->fetchAll(PDO::FETCH_ASSOC)){
    if ($username == $row['USE_USERNAME']){ ...

Second Statement : If the user enters good datas, i can insert inputs into my database.

$request = $db->prepare("INSERT INTO users (USE_USERNAME, USE_EMAIL, USE_PASSWORD) VALUES (:username, :email, :password)");
            $request->bindParam(':username', $username, PDO::PARAM_STR);
            $request->bindParam(':email', $email, PDO::PARAM_STR);
            $request->bindParam(':password', $pass_hache, PDO::PARAM_STR);
            $request->execute();

My problem :

When i insert 'OR 1=1' in an input, i can insert the same e-mail address in the database.

I searched in this website a solution and i added those lines to my database connection :

    $db->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);

But my datas insert even i put error messages in my PHP code (with Javascript popups in my while loop).

I am a beginner, i'm searching to Similar questions, but thank you for your help if you have an answer :)

Have a nice day :)

Edit : I will explain you when I manage errors in PHP :

while ($row = $request->fetchAll(PDO::FETCH_ASSOC)){
    if ($username == $row['USE_USERNAME']){
        ?>
        <script type="text/javascript">
            alert("Erreur#5 : Pseudonyme Faux !");  //Cas dans lequel les identifiants sont incorrects.
            document.location.href="subscribe.php";
        </script>
        <?php
        $error++;

It's very banal, but i have a variable $error that begins at 0, and I increment it in order to stop the PHP script.

There's errors for an unique Username and email. Before my prepare statements, my errors worked, but now I want prevent my form from SQL Injections.

1 Answers
Related