检查mysql表中字段是否为空，如果没有更改值

Question

我想在我的网站上做一个改变用户信息的部分，一切都有效，除了改变用户名部分。

在这一部分中，我必须检查newUsername是否未被占用，然后更改它(如果尚未被占用)。

当我启动我的代码时，它不会在(echo "username deja utiliser")之后输入(else if)语句。

//change.php
$newUsername = $_POST['changeUsername'];
$newNom = $_POST['changeNom'];
$currentId = $_SESSION['id'];
$currentName = $_SESSION['name'];
//fonction that doesn't work
if(empty($newUsername)){
echo "username is empty";   
}else if ($stmt = $con->prepare('SELECT username from users where USERNAME = ? ')) {
$stmt->bind_param('s', $newUsername);
$stmt->execute();
$stmt->store_result();
if ($stmt->num_rows > 0) {
$stmt->bind_result($checkUsername);
$stmt->fetch();
if ($checkUsername === $newUsername) {
echo "username deja utiliser";
}else if($stmt = $con->prepare("UPDATE users SET USERNAME = '$newUsername' WHERE ID = ? ")){
$stmt->bind_param('s', $currentId);
$stmt->execute();
echo "les valeur on été modifier";
session_regenerate_id();
$_SESSION['name'] = $newUsername;
}else{
echo "les valeurs n'ont pas été modifier";
}
}
}
//function that works
if(empty($newNom)){
echo "nom is empty";
}else if($stmt = $con->prepare("UPDATE users SET NOM = '$newNom' WHERE ID = ? ")){
$stmt->bind_param('s', $currentId);
$stmt->execute();
echo "les valeur on été modifier";
}else{
echo "les valeurs n'ont pas été modifier";
}

//editProfile.php
<form action="change.php" method="POST">

<table>
<tr>
<td>Username:</td>
<td>
<label for="username"></label>
<input type="text" name="changeUsername" placeholder="<?php echo $_SESSION['name'] ?>" id="changeUsername">
</td>
</tr>
<tr>
<td>Nom:</td>
<td>
<label for="nom"></label>
<input type="text" name="changeNom" placeholder="<?php echo $nom ?>" id="changeNom">
</td>
</tr>
</table>
<input type="submit" value="modfier">
</form>

Answer 1

最后我找到了一些工作。这个代码对SQL注入安全吗?

//check if the username is taken 
if(empty($newUsername)){
echo "username is empty";
}else if ($stmt = $con->prepare('SELECT username from users where USERNAME = ? ')) {
$stmt->bind_param('s', $newUsername);
$stmt->execute();
$stmt->store_result();
if ($stmt->num_rows > 0) {
$stmt->bind_result($username);
$stmt->fetch();
if ($username === $newUsername) {
$checkUsername = true;
}
}
}
//change the username
if (empty($newUsername)) {
echo "username is empty";
} else if ($checkUsername != true) {
if ($stmt = $con->prepare("UPDATE users SET USERNAME = ? WHERE ID = ? ")) {
$stmt->bind_param('si', $newUsername, $currentId);
$stmt->execute();
echo "les valeur on été modifier";
session_regenerate_id();
$_SESSION['name'] = $newUsername;
} else {
echo "les valeurs n'ont pas été modifier";
}
} else {
echo "username deja utiliser ";
}