Check Name Against A Database

[rawkinyeti]

Quick (hopefully) question. Ive used this script in a couple of different applications before and it has done what i want it to do. Basically i search my table for someone with the name that they entered from the form. If the are included in the database, they can continue, if they are not, then they are given an error message.

<?php$finduser = $conn->prepare("SELECT autonumb FROM faculty WHERE lastname = ? and firstname = ?");   $finduser->bind_param("ss",$lastname, $firstname);   $finduser->execute();   $finduser->store_result();   $num_rows = $finduser->num_rows;   $finduser->bind_result($num_rows);     if($num_rows == 0)   echo header("Location: error.html");	     else   //continue script?>

So what happens is in testing this is I supply a name that i know is included in my database table, but i am given the error page. Just looking at the information here could anyone deduce why? I can include the entire script if it is needed. My understanding of the script is the query is asked and the answer is stored to $num_rows. Then the if statements asks if there is anything present in the answer variable, if not it should precede to the error message, but if there is an answer you can continue. Am I looking at this the wrong way? I'm pretty confused, because ive used this else where and gotten my desired result. The case were not identical, but the idea of checking the database to see if it was an entry is the same.

[justsomeguy]

There's no reason to use bind_result if you're just trying to get the number of records that were returned.

[thescientist]

have you verified the values of $firstname and $lastname? All that code is doing is making a query and checking the amount of rows returned. An error in this case is no rows returned, presumably because the user could not be found, and thus no rows could be returned. I can't speak for any of the custom methods, like bind_xxxx, or whatnot, but I would first start by double checking where your variables come from.

[justsomeguy]

I can't speak for any of the custom methods, like bind_xxxx

That's the mysqli extension, it's built-in.

[thescientist]

That's the mysqli extension, it's built-in.

good call. after your previous post I thought that and quick google search brought about that realization. so it's more for use with prepared statements then, and not seemingly necessary within this context?

[justsomeguy]

This is a prepared statement, but there's no reason to get the value of one of the fields that was returned if the desired outcome is only the number of rows.