Code Issue

fus10n

hello, i am trying to make a register fourm and i am having some issuse here is the error: Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home2/yourclas/public_html/registernext.php on line 22

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home2/yourclas/public_html/registernext.php on line 29

and here is the code

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>

<body>
<?php
include('confirmation.php');


//test to see if username is alphanumeric
$test=$_POST['name'];

if(!eregi("[^A-Za-z0-9]",$test))
{


   $query="SELECT * FROM mfc WHERE name ='$_POST(name)'";
   $result=mysql_query($query);
   $num=mysql_num_rows($result);

   if($num == 0)
   {

     $query2="SELECT * FROM mfc WHERE name ='$_POST(email)'";
     $result2=mysql_query($query2);
     $num2=mysql_num_rows($result2);

     if ($num2 == 0)
     {
        if(($_POST[pw]==$_POST[confpw])&&($_POST[email]==$_POST[confemail]))

        {
           $confirm_code=md5(uniqid(rand()));


           $name=strip_tags($_POST['name']);
           $email=strip_tags($_POST['email']);
           $pw=strip_tags($_POST['pw']);


           $sql="INSERT INTO tmp SET code='$confirm_code', name='$name', email='$email', pw='$pw'";
           $result=mysql_query($sql);

              if($result)
              {
              $message="Your Confirmation link \r\n";
              $message="Click on this link to activate your account \r\n";
              $message="localhost/confirmation.php?passkey=$confirm_code";

              $sentmail=mail("$email",'Registration Confirmation',"$message",'From: admin@localhost');
              header("Location:thankyou.html");
              }
              else
              {
               echo "Not found your e-mail in our database";
              }

              if($sentmail)
              {
              echo "Your Confirmation link has been sent to your e-mail account";
              }
              else
              {
              echo "cannot send confirmation link to your e-mail adress";
              }
        }
     }
     else
     {
     header("location:badmatch.html");                              
     }
   }   

   else
   {
   header("Location:emailinuse.html");
   }


}   

else
{
header("Location:nameinuse.html");
}

?>



</body>
</html>

Pikachu2000

The query is failing. You've used parentheses instead of square brackets on the $_POST array element, and the index should be quoted, technically. Check all of your query strings, that wasn't the only one with those problems. You should really consider sanitizing your form values before using them in a database query. Also, eregi is deprecated, and in that context is unnecessary. Simply using ctype_alnum() would be more than adequate.

$query="SELECT * FROM mfc WHERE name ='{$_POST['name']}'";