Mysqli prepared sentences

Question

Hello, I have a problem, I would like to know about prepared sentences, I have this code:

$query_email = ("SELECT email FROM usuarios_ WHERE email = ?");

$stmt = mysqli_stmt_init($conn);
if (mysqli_stmt_prepare($stmt, $query_email)) {     
   mysqli_stmt_bind_param($stmt, 's', $email);
   mysqli_stmt_execute($stmt);
   mysqli_stmt_bind_result($stmt, $resultado);
   mysqli_stmt_fetch($stmt);

   echo $resultado;

   mysqli_stmt_close($stmt);        
}

So far so good, my question is, how to know if it worked or not, because as it is a login system I have to pass the return to the user if the email exists or not.

Answer 1

If it’s a login system, there’s a problem - I don’t know if this is all your code, but if it is, you should also look for the password, never just email. If your goal is just to inform the user whether or not the email exists (during the login process), I say this is a bad idea. You’re handing an attacker half the information he needs to hack into your system.

mysqli_stmt_fetch returns true/false if a record is found, you can use this to perform a check and know whether or not the email exists in your database. I think that’s what you want.

To retrieve the value persisted in your database, and store in variables, use the mysqli_stmt_bind_result. There are some examples in the function documentation on how to use it.