Conditional prepared statement not switching

Question

I have the following PHP code, which is meant to insert data in the event that the username field is empty for a given username, or update data if a username exists. At the moment, the insert was previously working fine, but it would never switch to the update clause.

Now however, the insert clause fails to recognise my test variable, for no apparent reason. The errors I get are:

Warning: mysqli_fetch_assoc() expects parameter 1 to be mysqli_result, boolean given

and

Notice: Undefined variable: checkUsername

which are quite recent.

if($cmd=="submitinfo"){

$usernameQuery = "select username from USERS where username = $username";

$xblah = $con->query($usernameQuery);
  while ($row = mysqli_fetch_assoc($xblah))
  {
    $checkUsername = $row['username'];

  }

if ($checkUsername == null) {

$userQuery = "INSERT INTO USERS VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";
if ($userInfo = $con->prepare($userQuery)) {
    $userInfo->bind_param("ssssssssssssssssssss", $username, $firstname, $lastname, $flaggedauctions, $lastauction, $street1, $city1, $postcode1, $street2, $city2, $postcode2, $phone, $mobilephone, $fax, $email, $website, $bank, $banknumber, $accountnumber, $comments);
    $userInfo->execute();
    $userInfo->close();
    echo "true";
} else {
echo "false";
}
print_r($con->error);
}

else if ($checkUsername == $username) {

$userQuery = "UPDATE USERS SET firstname = ?, lastname = ?, flaggedauctions = ?, lastauction = ?, street1 = ?, city1 = ?, postcode1 = ?, street2 = ?, city2 = ?, postcode2 = ?, phone = ?, mobilephone = ?, fax = ?, email = ?, website = ?, bank = ?, banknumber = ?, accoutnumber = ? WHERE username = ?";
if ($userInfo = $con->prepare($userQuery)) {
    $userInfo->bind_param("sssssssssssssssssss", $firstname, $lastname, $flaggedauctions, $lastauction, $street1, $city1, $postcode1, $street2, $city2, $postcode2, $phone, $mobilephone, $fax, $email, $website, $bank, $banknumber, $accountnumber, $username);
    $userInfo->execute();
    $userInfo->close();
    echo "true";
} else {
echo "false";
}
print_r($con->error);
}
}

What is a preferred way to do an update or an insert depending on the content of $username matched against the username field?

Answer 1

Warning: mysqli_fetch_assoc() expects parameter 1 to be mysqli_result, boolean given

That's your error message? I think your problem is this line:

$xblah = $con->query($usernameQuery);

Do a var_dump on $xblah. I suspect your query is failing. Probably because you haven't fetched $username from your input. And for love of root, be sure to escape it! mysql_real_escape_string() will do what you want.

Answer 2

If you are using MySQL and the username is unique, you can use this handy SQL:

INSERT INTO users (?, ?, ...) ON
DUPLICATE KEY UPDATE firstname=?,
lastname=?, ...)

See http://dev.mysql.com/doc/refman/5.0/en/insert-on-duplicate.html for full documentation.