Ckeck if user email is listed in database

[Dlan]

I’m not sure if I’m posting this to the correct place or not, but here it is..

I’ve been using a simple membership on my site for years. I’ve just installed BB3. I’m slowly moving everyone over to BB membership. I’m looking to set it up so once people have logged in to BB they will be able to use rest of the site as before. I think I’ve most of it figured out but I’m getting stuck on checking if their email is in the BB database.

This is what I have, but it ‘just did not work’. Could someone tell me what is wrong

Code: Select all

con_db_BB3.php:
$con = mysqli_connect($dbhost, $dbusername, $dbpasswd, $db_name) or die("Couldn't connect to data base in con_db_BB3");
-----
include 'inc/con_db_BB3.php';

if (isset($_POST['email_address']))    
{    
$email_address = $_POST['email_address'];              
}  
if(!$email_address)
{
	echo "<h2 align=\"center\">Please enter your email address </h2><br>";
	exit();
}

 if (!$con) {
  	die("Connection failed : " . mysqli_error());
 }

  
$query = mysqli_query($con, "SELECT *  FROM phpbb_users WHERE user_email = ' $email_address ' ") or die ("just did not work <br>" . mysqli_error($con));
  
 if(mysqli_num_rows($query) > 0)
 {
    echo "email  exists";
	$MEMB = 1;  //is member
}else{ 
 	echo "cant find email ";
 	$MEMB = 0;  //is not member
} 
 exit();  
 ?> 

Thanks in advance, Don..

[Spam link removed]

[Kailey]

Maybe this?

Code: Select all

mysqli_query($con, "SELECT * FROM phpbb_users WHERE user_email = '$email_address'") or die ("just did not work <br>" . mysqli_error($con));

[Paul]

please make sure to escape $email_address as this script is curdently vulnarble to sql injection.

[AmigoJack]

Code: Select all

' $email_address '

E-mail addresses are never stored with a leading and a trailing space - remove them and be aware of user input like

Code: Select all

'; DROP DATABASE;'

[Dlan]

Yep, that fixed it..
Thanks for your help

Don...