views:

40

answers:

2

Here is the code.

I really dont why it is not submitting my information.

<?php

//Includes mass includes containing all the files needed to execute the full script
//Also shows homepage elements without customs

include ("includes/mass.php");


//Grabbing data form POST array and storing in variables plus the date

$username   = ($_POST['username']);
$password   = ($_POST['password']);
$conpassword= ($_POST['password2']);
$firstname  = ($_POST['firstname']);
$lastname   = ($_POST['lastname']);
$email      = ($_POST['email']);
$submit     = ($_POST['submit']);
$date       = date("Y-m-d");


//Reigstration Form         

$register = "<div id='registration'> 
                <h2>Register Here!</h2>
                <form action='register.php' method='post'> 
                <table>
                <tr>
                    <td>
                Username
                    </td>
                    <td>
                <input type='text' name='username' value='$username' >
                    </td>
                </tr>
                <tr>
                    <td>
                Password
                    </td>
                    <td>
                <input type='password' name ='password'>
                    </td>
                </tr>
                <tr>
                    <td>
                Confirm Password
                    </td>
                    <td>
                <input type='password' name ='password2'>
                    </td>
                </tr>
                <tr>
                    <td>
                Firstname
                    </td>
                    <td>
                <input type='text' name='firstname' value='$firstname'>
                    </td>
                </tr>
                <tr>
                    <td>
                Lastname
                    </td>
                    <td>
                <input type='text' name='lastname' value='$lastname' >
                    </td>
                </tr>
                <tr>
                    <td>
                Email
                    </td>
                    <td>
                <input type='text'  name='email' value= '$email' >
                    </td>
                </tr>
                <tr>
                    <td>
                <input type='submit'  class='button' name='submit' value='Sign Up'>
                    </td>
                </tr>
                </table>    
                </form>
            </div>";

echo $register;         


//Check to make sure user has submitted the correct details
echo "<div id='regform'>";
    if (isset($submit))

        {
            //Querying the database for if the username already exists

            $sql = "SELECT * FROM user WHERE username = '$username'";

                       $query = mysql_query($sql);

                     $numrows = mysql_num_rows($query);

                     while ($row = mysql_fetch_assoc($query))

                                    {
                                     $dbusername = $row['username'];
                                     $dbpassword = $row['password'];
                                    } 

                if (strlen($username)<2)

                    {

                     echo ("<br>You must enter a longer username</br>");

                     exit;

                    }

                elseif (strlen($username) > 25)

                    {
                     echo ("You must enter a shorter username<br>");

                     exit;

                    }

                if ($username==$dbusername)

                    {

                     echo ("That username already exists!");

                     exit;

                    }

                elseif (strlen($password)<6) 

                    {

                     echo ("<br>'Password must be be between 6 & 26 characters'<br>");

                     exit;

                    }

                 if ($password != $conpassword)

                    {

                     echo ("<br>Your passwords dont match<br>");

                     exit;

                    }

                elseif (strlen($firstname)<=0) 

                    {

                     echo ("<br>You must enter your firstname<br>");

                     exit;

                    }

                if (strlen($lastname)<=0) 

                    {

                     echo ("<br>You must enter your lastname<br>");

                     exit;

                    }

                elseif (!preg_match('/@/',$email) || (strlen($email)<=6) ) 

                    {

                     echo ("</br>You must enter a proper email address!");

                     exit;

                    }

                if (!isset($password))

                    {
                     echo "You must enter a password!";

                     exit;

                    }

                elseif (!isset($conpassword))

                    {

                     echo ("You must confirm your password");

                     exit;

                    }

                else

                    {

                        //Encrypt the password

                        $password = md5($password);
                        $conpassword = md5($conpassword);

                        //Start Session

                        session_start();

                        //push this information to the database

                        //Submit data to database plus store exec into variable.

                        $sqlsubmit ="INSERT INTO user VALUES ('','$firstname','$lastname','$username','$password','$email','$date',)";

                        mysql_query($sqlsubmit);

                        //echo success.



                     echo "successfully submitted to the database"."<br>"."<a href='user.php'>Click Here To Go To Your Accont</a>";

                     exit;


                    }   

         }  

    elseif(!isset($submit))

        {
         echo "</br>"."Enter your info here!!!!! :))";
        }

echo "</div>";  

?>
+1  A: 

Update: As Quassnoi so subtly points out, you urgently need to secure your input. See the chapter SQL Injection in the PHP manual.

The query fails because you have an extra comma at the end of the line:

  $sqlsubmit ="INSERT INTO user VALUES 
 ('','$firstname','$lastname','$username','$password','$email','$date',)";

Use echo mysql_error(); to find out such errors.

Also, the success message gets output, regardless whether the query fails or not. You want to add a condition:

if (mysql_query($sqlsubmit))
 echo "successfully submitted ...";
else
 echo "error submitting ..... ".mysql_error();
Pekka
Hint: you always get more points if you embed this picture in an answer to a question like that: http://xkcd.com/327/
Quassnoi
thank you pekka! its always the small ones eh..
Tapha
@Tapha you're welcome. Also check out my edited answer. @Quassnoi, you're right of course :)
Pekka
is that to go into my else statement at the end? Also where can i put the session start for the session to start when the user clicks the "Go to My Account link" thanks again mate!.
Tapha
Thanks for the heads up about the sql attack risk. Im fixing that now!
Tapha
@Tapha the block is to replace the mysql_query() statement and the subsequent "success" echo. The latter I don't know - but session_start() always belongs to the head of the script.
Pekka
Thanks Pekka. You've really been helpful on this
Tapha
+2  A: 

It has been state by Pekka as well as in a comment... but since this is very important, I'll repeat it in a separate (community wiki) answer:


This code is vulnerable to SQL-injection attacks of the worst kind.

Your code is absolutely insecure. It should not be used, no excuses possible. Go read about SQL-Injection and input sanitisation before you proceed any further.


Exploits of a Mom http://xkcd.com/327/

Jacco
Thanks. lol We live and learn.
Tapha
+1 for a great use of xkcd!
Mark Tomlin