is this right? (check code please)

[coiL]

Hi,
As far as I can tell my script works fine but I wanted to check that I had written it in the right way. Thanks.

$sql = "SELECT email FROM user WHERE username = '$username'";
        
            if (!mysql_query($sql))
        error("A database error occurred in processing your ".
              "request.\\nIf this error persists, please ".
              "contact [email]name@email.com[/email].");
        
        $query = mysql_query($sql, $db);

        // Check the database to see if anything matches the entered details.
        $number_of_matches = @mysql_num_rows($query);
            
            // If there is a matching entry, reset and send the password
            if($number_of_matches >= '1')
                {
    
            $result = mysql_fetch_object($query);        
               $mail_to = $result->email; 

[Mincer]

IMHO your code is flawed. You perform the query twice when there is no need to, which is a waste of resources. And as part of your logic, even if the query fails, you still try and do it again.

Also when you check if number_of_matches is greater than or equal to one, you should not put the 1 in quotes as it is a numerical value you are checking, not a string. And, why are you checking greater than or equal to 1 and then only processing one result? You should either be checking that you have exactly one match and then processing it (or failing), or checking for more than that, and looping through the results (the code below is edited to assume you want one match).

$sql = "SELECT email FROM user WHERE username = '$username'" ;

$query = @mysql_query( $sql ) ;

if( ! $query )
{
    error("A database error occurred in processing your ".
          "request.\nIf this error persists, please ".
          "contact [email]name@email.com[/email].") ;
}
else
{
    // If there is a matching entry, reset and send the password
    if( mysql_num_rows( $query ) == 1 )
    {
        $result = mysql_fetch_object( $query ) ;
        $mail_to = $result->email ;
    }
    else
    {
        error( "There was no distinct match" ) ;
    }
} 

Hope this helps,

Matt.