Signup Problem

[nazgul42]

Ok... this is my third problem today, but here goes:
On my signup page for my login system on my website, I have some code that is supposed to check if a username is already taken and give an error if it is. The problem is that I submit a set of values, and it works as expected. Then I submit the same set of values, and it enters them into the database anyways. this is my code:
[PHP]
<?php
session_name("S IGNUP");
session_start() ;
$_SESSION['Error'] = 0;
$_GLOBALS['Username'] = ucwords(strtolo wer($_POST['Username']));
$_GLOBALS['RSUsername'] = ucwords(strtolo wer($_POST['RSUsername']));
$_GLOBALS['Password'] = ucwords(strtolo wer($_POST['Password']));
@mysql_connect( "mysql3.freehos tia.com", "jonaxt3_genera l", "******") or die("Cannot Connect To DB!");
@mysql_select_d b("jonaxt3_gene ral") or die("Cannot Select DB!");
$sql = "SELECT username FROM users WHERE username = '" . $_GLOBALS['Username'] . "';";
$r = mysql_query($sq l);
if (mysql_num_rows ($r) != 0)
{
$_SESSION['Error'] = "That Username Is Already Taken";
}
$sql = "SELECT rsusername FROM users WHERE rsusername = '" . $_GLOBALS['RSUsername'] . "';";
$r = mysql_query($sq l);
if (mysql_num_rows ($r) != 0 && $GLOBALS['Error'] == 0)
{
$_SESSION['Error'] = "That Runescape Username Is Already Taken";
}

if ($_SESSION['Error'] == 0)
{
$sql = "INSERT INTO users (username, password, rsusername) VALUES('" .
$_GLOBALS['Username'] .
"','" .
$_GLOBALS['Password'] .
"','" .
$_GLOBALS['RSUsername'] .
"');";
$r = mysql_query($sq l);
if(!$r) {
echo "Error!";
$err=mysql_erro r();
print $err;
exit();
}
header("Locatio n: index.htm");
}
else
{
header("Locatio n: signupform.php" );
}
?>
[/PHP]
It started when I added the lines:
$_GLOBALS['Username'] = ucwords(strtolo wer($_POST['Username']));
$_GLOBALS['RSUsername'] = ucwords(strtolo wer($_POST['RSUsername']));

[Atli]

In line #23; any value $_SESSION['error'] has, other than FALSE or a number greater than zero, will be evaluated as true.
By that I mean:

0 == TRUE. 
1 or higher == FALSE.
"Any text" == TRUE.
 

Which would mean that the if statement in line #23 will consider any error message to be 0 (or TRUE).

Consider this:

<?php
    $error = 0;
 
    $error = "Hello";
 
    if($error == 0) { // "Hello" == 0 == TRUE
        echo "No error";
    }
    else {
        echo "Error!";
    }
?>
 

This will echo "No error"


Also...

Why do you put the user info into $GLOBAL? You could just as well create normal variables, which would be much safer (theoratically) .
Also, why do you put the 'Error' variable in the Session?

The password shouldn't be capitalized with the ucwords() function like the usernames are.
You should also consider hashing the passwords using SHA1 or MD5, just to make them more secure.

[nazgul42]

Thank You for your response, and I will try it as soon as possible.