There is output written to the browser before in the event of an error. the entire code looks like this
<?php
require_once 'function3.php';
$first_name = $_POST['first_name'];
$last_name = $_POST['last_name'];
$email_address = $_POST['email_address'];
$password = $_POST['password'];
$password2 = $_POST['password2'];
$username = $_POST['username'];
$first_name = stripslashes($first_name);
$last_name = stripslashes($last_name);
$email_address = stripslashes($email_address);
$username = stripslashes($username);
// has the form been submitted?
if (isset($_POST['submit'])) {
// the form has been submitted
// perform data checks.
$sql_email_check = mysql_query("SELECT email_address FROM users WHERE email_address='$email_address'");
$sql_username_check = mysql_query("SELECT username FROM users WHERE username='$username'");
$email_check = mysql_num_rows($sql_email_check);
$username_check = mysql_num_rows($sql_username_check);
$error_str = ''; // initialise $error_str as empty
if (empty($_POST['first_name'])) $error_str .= '<li><font color="#FFFFFF" size="2" face="Verdana, Arial, Helvetica, sans-serif">You did not enter your first name</font></li>';
if (empty($_POST['last_name'])) $error_str .= '<li><font color="#FFFFFF" size="2" face="Verdana, Arial, Helvetica, sans-serif">You did not enter your last name</font></li>';
if (empty($_POST['email_address'])) $error_str .= '<li><font color="#FFFFFF" size="2" face="Verdana, Arial, Helvetica, sans-serif">You did not enter your E-mail address</font></li>';
if (empty($_POST['username'])) $error_str .= '<li><font color="#FFFFFF" size="2" face="Verdana, Arial, Helvetica, sans-serif">You did not enter your desired username</font></li>';
if (empty($_POST['password'])) $error_str .= '<li><font color="#FFFFFF" size="2" face="Verdana, Arial, Helvetica, sans-serif">You did not enter your desired password</font></li>';
// more checks
if ($_POST['password'] != $_POST['password2']) $error_str .= '<li><font color="#FFFFFF" size="2" face="Verdana, Arial, Helvetica, sans-serif">Your passwords do not match.</font></li>';
if (!preg_match("/.*@.*..*/", $_POST['email_address']) | preg_match("/(<|>)/", $_POST['email_address'])) $error_str .= '<li><font color="#FFFFFF" size="2" face="Verdana, Arial, Helvetica, sans-serif">Invalid E-mail address</font></li>';
if ($email_check > 0) $error_str .= '<li><font color="#FFFFFF" size="2" face="Verdana, Arial, Helvetica, sans-serif">E-mail address already in use, select another.</font></li>';
if ($username_check > 0) $error_str .= '<li><font color="#FFFFFF" size="2" face="Verdana, Arial, Helvetica, sans-serif">Username already in use, select another.</font></li>';
// we could also strip any HTML from the variables, convert it to entities, have a maximum character limit on the values, etc etc, but this is just an example.
// now, have any of these errors happened? We can find out by checking if $error_str is empty
if (!empty($error_str)) {
// errors have occured, halt execution and show form again.
echo '<p><div align="center"><font color="#FFFFFF" size="2" face="Verdana, Arial, Helvetica, sans-serif">There were errors in the information you entered, they are listed below:</font></div></p>';
echo '<ul>'.$error_str.'</ul>';
// show form again
user_form();
} else {
$sql = "INSERT INTO USERS (first_name, last_name, email_address, username, password, signup_date)
VALUES('$first_name', '$last_name', '$email_address', '$username', '$password', NOW())";
@mysql_query($sql) or die(mysql_error().'<p>'.$sql.'</p>');
if (mysql_affected_rows() < 1) {
echo 'There has been an error creating your account. Please contact the webmaster.';
user_form();
} else {
echo '<p><font color="#FFFFFF" size="3" face="Verdana, Arial, Helvetica, sans-serif">Successfully submitted, please <a href="IAM_login.php">login </a> now</font></p>';
}
}
}
?>