Validate if username already exists - mysql

Question

In the form that I create new users, I would like it to validate if the username already existed or not, then in the register button I put the following code:
Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click
Try
Dim Inserir As String = "INSERT INTO `techstorehunter`.`utilizadores`(`Username`,`Password`,`pergunta`,'resperg')VALUES('" & TextBox1.Text & "','" & TextBox2.Text & "','" & TextBox3.Text & "','" & ComboBox1.Text & "')"
ExecuteQuery(Inserir)
Catch
MessageBox.Show("Username already exists")
End Try
If TextBox1.Text = "" Then
MessageBox.Show("Insert a username")
End If
If TextBox2.Text = "" Then
MessageBox.Show("Insert a password")
End If
If TextBox3.Text = "" Then
MessageBox.Show("You need to answer a question")
End If
If ComboBox1.Text = "" Then
MessageBox.Show("You need to select a question")
End If
End Sub
But everytime I create a user it says that it already exists, even if not, what i can do? Thanks.
PS : "Inserir" means "Insert" but my language is Portuguese.

Answer 1

There are several issues with your code :
First, you validate the input after running the sql query : you should validate first, and if everything goes well then do the INSERT, otherwise you are exposing to either inserting dumb data to database, or getting the « User already exists » warning on incomplete input
Also, you catch all database errors and interpret them as « User already exists » ; by proceeding this way you are potentially hiding other database errors than duplicate user record. The proper way to proceed is to :
after form validation, check for per-existing user with a query like follows, where the question mark should be replaced by the submitted user name. If the query returns anything, then you know that you have a duplicated user for sure, and you can raise the appropriate warning and stop the processing.
SELECT 1 FROM `techstorehunter`.`utilizadores` WHERE `Username` = ?
if the first query returns nothing, you can run the INSERT statement
everytime your run a query, you want to catch errors, report them with the full error message, and abort the processing