title: PHP SQL Injection - Executing and returing empty value
body: <p>I have an IOS application that executes a PHP Script but when i test in the browser and in IOS i get empty string returned from PHP script call:</p>
  
  <p>PHP Version is 5.2</p>
  
  <p>This is the url i am calling :</p>
  
  <p><a href="http://hugt.co.uk/checkUserVerification.php?Email=tp_redo_c@hotmail.com&amp;Password=ULLAFI01" rel="nofollow">http://hugt.co.uk/checkUserVerification.php?Email=tp_redo_c@hotmail.com&amp;Password=ULLAFI01</a></p>
  
  <p>But the echoed value is empty string. Is the script fine or am i making errors somewhere?</p>
  
  <p>I was using other functions to call MYSQL but commented those out to check for SQL Injection so I'm not familiar with the code I'm using.</p>
  
  <p>PHP Code:</p>
  
  <pre><code>&lt;?php
  
          include "connect.php";
  
  
          $email = $_REQUEST["Email"];
          $password = $_REQUEST["Password"];
  
          $verificationCode = null;
          if(isset($_REQUEST['Verification'])){
  
              $verificationCode = $_REQUEST["Verification"];
          }
  
          $hasBeenVerified = 0;
          $stmt = $mysqli-&gt;prepare("SELECT U_Verified, U_ID FROM U_User WHERE U_Email = ? AND U_Password = ?");
          $stmt-&gt;bind_param("ss", $email, $password);
          $stmt-&gt;execute();
          //$stmt-&gt;bind_result($district);
          //$stmt-&gt;fetch();
          $result = $stmt-&gt;get_result();
          $myrow = $result-&gt;fetch_assoc();
          $stmt-&gt;close();
  
  
          if($myrow){
  
              $hasBeenVerified = $myrow['U_Verified'];
              if($hasBeenVerified == 1){
  
                  echo $myrow['U_ID'];
                  exit();
  
  
              }else{
  
                  if($verificationCode != null){
  
                      $stmt = $mysqli-&gt;prepare("SELECT U_VerificationCode, U_ID FROM U_User WHERE U_Email = ? AND U_Password = ?");
                      $stmt-&gt;bind_param("ss", $email, $password);
                      $stmt-&gt;execute();
                      $result2 = $stmt-&gt;get_result();
                      $myrow2 = $result2-&gt;fetch_assoc();
                      $stmt-&gt;close();
  
                      if($myrow2['U_VerificationCode'] == $verificationCode){
  
                          $stmt = $mysqli-&gt;prepare("UPDATE U_User SET U_Verified = true WHERE U_Email = ?");
                          $stmt-&gt;bind_param("s", $email);
                          $stmt-&gt;execute();
                          $result3 = $stmt-&gt;get_result();
                          //$myrow3 = $result2-&gt;fetch_assoc();
                          $stmt-&gt;close();
  
                          if($result3){
                              echo $myrow2['U_ID'];
                              exit();
                          }else{
                              echo 'server error';
                              exit();
                          } 
                      }else{
                          echo 'invalid verification';
                          exit();
                      }
  
  
  
  
                  }else{
  
  
                      echo 'no verification';
                      exit();
                  }
  
              }
  
  
  
          }else{
              echo 'not registered';
              exit();
          }
  
          /**$hasBeenVerified = 0;
          $qryCheck = "SELECT U_Verified, U_ID FROM U_User WHERE U_Email = '$email' AND U_Password = '$password'";
          $resultCheck = mysqli_query($conn, $qryCheck);
          $num_rows = mysqli_num_rows($resultCheck);
  
          if($num_rows &gt; 0){
              $row = mysqli_fetch_row($resultCheck);
              $hasBeenVerified = $row[0]; 
              if($hasBeenVerified == 1){
  
                  echo $row[1];
                  exit();
  
              }else{
  
                  if($verificationCode != null){
  
                      $qryCheck2 = "SELECT U_VerificationCode, U_ID FROM U_User WHERE U_Email = '$email' AND U_Password = '$password'";
                      $resultCheck2 = mysqli_query($conn, $qryCheck2);
                      $row2 = mysqli_fetch_row($resultCheck2);
                      if($row2[0] == $verificationCode){
                          $updateRecordVerified = 'UPDATE U_User SET U_Verified = true WHERE U_Email = "$email"';
                          $resultCheck3 = mysqli_query($conn, $updateRecordVerified);
                          if($resultCheck3){
                              echo $row2[1];
                              exit();
                          }else{
                              echo 'server error';
                              exit();
                          }                                                   
                      }else{
                          echo 'invalid verification';
                          exit();
                      }
  
                  }else{
                      //echo 'hhh' . $row[0];
                      echo 'no verification';
                      exit();             
                  }
  
  
              }       
  
  
          }else{
              echo 'not registered';
              exit();
          }
  
          mysqli_close($conn);**/
          $mysqli-&gt;close();
      ?&gt;
  </code></pre>