please check validation

Question

Hi frnds,i am inserting day value to database,i want validation like if the day already exist it should say day already exist else it should innsert..please can anyone check the following code... thaanks in advance

$dexist=$_POST['ext'];
$res=mysql_query("select Day from mess where Day='".$dexist."' ");
while($row=mysql_fetch_array($res))
{
    $dy=$row['Day'];
}

if($dy==$dexist)
{
    echo "<script language=\"javascript\">";
    echo "window.alert ('File already exist');";
    echo "//--></script>";

}
else
{
    mysql_query("insert into mess (Date,Day,Breakfast,StartTimeb,EndTimeb,Lunch,StartTimel,EndTimel,Dinner,StartTimed,EndTimed) values('".$date."','".$day."','".$bre."','".$bres."','".$bree."','".$lun."','".$luns."','".$lune."','".$dinn."','".$dins."','".$dine."')");
}

Answer 1

Your script screams "SQL INJECTION!" Please pwn my site!

Also: your code is vulnerable to synchronization issues. For example, a file might be created AFTER you ran a select statement, but BEFORE you ran the INSERT statement. This will cause weird failures. That's why you should do the "select and insert" as a single stored proc (read up on atomic operations - more specifically, this is an instance of a "compare and swap").

Answer 2

This is a repost of your question.

searching for the original..

found it.. http://stackoverflow.com/questions/1802738/want-to-check-day-already-exist

Answer 3

Don't do that in PHP, it's difficult (impossible?) to do safely. Do it in MySQL by adding a unique index on the Day column:

ALTER TABLE mess ADD UNIQUE (Day);

You can then catch failures of that kind by looking for ER_DUP_UNIQUE from MySQL.

Use PHP's mysql_errno to check for error 1169 to catch unique constraint failure.

$query_result = mysql_query("insert into mess (Date,Day,Breakfast,StartTimeb,EndTimeb,Lunch,StartTimel,EndTimel,Dinner,StartTimed,EndTimed) values('".$date."','".$day."','".$bre."','".$bres."','".$bree."','".$lun."','".$luns."','".$lune."','".$dinn."','".$dins."','".$dine."')");
// 1169 means a unique constraint failure
if (!$query_result && mysql_errno() == 1169) {
  echo "Oh noes, you tried to insert a value twice!";
}

Answer 4

Firstly never, ever pass unchecked POST/GET data into a MySQL query, it's a massive security hole. Use mysql_real_escape_string instead:

$res=mysql_query("select Day from mess where Day='" . mysql_real_escape_string($dexist) . "' ");

And similar for the latter call.

Secondly, it's not clear what you're asking... please tell us if the code is not working somewhere, and any errors you're getting. I think you have a problem with this line:

if(file_exists($dy==$dexist))

That is passing a boolean value ($dy==$dexist will evaluate to true or false) into the file_exists function. You need to pass the filename in.