PHP Search Not Matching Line in File

Question

Just creating a simple login system for a school club. And I am trying to send an error if the name that is entered does not match any line in the file containing student names. The file looks a bit like this:

Student One  8M2
Student Two  8M3
Student Three  8M2

The code below shows what is triggered when the search (or login credential) is submitted. The file is read into an array and then each value in that array is compared with the search.

if (isset($_POST['search'])) {
        $search = $_POST['search'];
        $students = file("students.txt"); // read file into array
        foreach ($students as $student) {
            if (strpos($student, $search) == false) { // not found in student list
                echo "<script type='text/javascript'>alert('You must enter your full name.');
                    window.open('signin.php', '_self');</script>";
                return false;
            }
        }
    }
}

Unfortunately, this leads to the user not being able to submit anything without getting "You must enter your full name". For instance, with entries like "Student One 8M2" and "fdskdsa".

However, when the if statement asks for a match (!== false), it correctly throws the javascript alert to anything that matches anything in the file.

Just to reiterate, I would like the alert to show when the user writes something that does NOT match any line in the file (students.txt).

EDIT: Tried:

• using "===" instead of "==" - same result
• using "strstr" instead of "strpos" - same result
• using "$_GET" instead of "$_POST" and also the urldecode() function on the variable - the former gave "undefined index" and combined with the latter, "strpos(): empty needle".

I am using Internet Explorer 11 by the way.

Answer 1

There are a lot of mistakes in your code. Some of them are already noted. You should use "===" and it's good to trip line-ending symbols. But main problem as I see is that you check in for loop, but exiting after very first string that does not contain correct name instead of processing all of them.

You should check all logins and exit only if none of them matches. So it should be something like that

...
$found = false;
foreach($students as $student) {
    if (strpos( $student, $search ) !== false ) {
        $found = true;
        break; //We found one. So we can to stop search
    }
}
if (!$found) {
    echo "
        <script type='text/javascript'>
            alert('You must enter your full name.');
            window.open('signin.php', '_self');
        </script>";
}

Next problem as I can see is that strpos is not good function to check if name exist as it's enough if entered string is only part of full string. For exapmle if I'm an evil student and entered (for example) just "e". Letter E contained in some of your students names, so it would be consedered fine. You should prevent that by comparing full string of extracting name part of string and comparing that part