Pressing Submit Refreshes

the3rdhero

Hey,

Last night i coded a silly little login script for practice. I'm not the world's best programmer, and I've not used php in over a year, I've been using pascal and C++.

Can anyone see why, when I push submit, the script just refreshes rather than submitting the data to MySQL?

<html>
<head><title>Register</title></head>
<body>
<?php
$self = $_SERVER['PHP_SELF'];;
$username = $_POST['username'];
$password = $_POST['password'];

if( ( $username == NULL ) or ( $password == NULL ) ) {
        $form ="Please enter all new user details...";
        $form.="<form action=\"$self\"";
        $form.="method=\"post\">Username: ";
        $form.="<input type=\"text\" name=\"username\"";
        $form.=" value=\"$username\"><br>Password: ";
        $form.="<input type=\"text\" names=\"password\"";
        $form.=" value=\"$password\"><br>";
        $form.="<input type=\"submit\" value=\"Submit!\">";
        $form.="</form>";
        echo( $form );
}else{
        // MySQL details
        $mysql_host="localhost";
        $mysql_user="user";
        $mysql_pass="pass";
        $mysql_dbname="db";


    //Connect to MySQL
    $conn = @mysql_connect( "localhost", "user", "pass" )
            or die("Could not connect to MySQL");


    //Selects the database
    $db = @mysql_select_db( "db", $conn )
                    or die("Could not select database");

    //creates the query
    $sql = "insert into users (username, password) values ('".$username."', '".$password."')";

    $result = @mysql_query( $sql, $conn )
            or die("Could not execute query");

    if( $result !== FALSE)  
             echo( "New user $username added" ); 
}
?>
</body>
</html>

etully

Not sure (haven't tested it) but I'd start by changing the line where you check to see if the username and password are null by changing this:

if( ( $username == NULL ) or ( $password == NULL ) ) {

to this:

if(  !$username  or  !$password  ) {

or this should work too:

if(  $username == ''  or  $password == ''  ) {

etully

By the way, since this is practice for you, I'll mention that it's EXTREMELY dangerous to take the variables from the user and insert them into a SQL query without checking them first. For example, if someone wanted to hack up your site, they could just make their password be this:

test');update users set password='owned!';

Now I've changed the password of every one of your users to "owned".

Scriptmaker

//line 15
        $form.="<input type=\"text\" names=\"password\"";

Should be changed to:

//line 15
        $form.="<input type=\"text\" name=\"password\"";

Notice the extra 's' on the NAME. It's sending the script a null value because password is null.

To troubleshoot things like this, I like to add an echo $variable; whenever I call upon a variable to do something, that way I can see if the variable is doing what I want it to.