god0fgod wrote:Thanks for the reply. I tried inserting the data your way but still the same thing happens. You may have misunderstood. Only the date works. Everything else doesn't. Date is the only thing that doesn't require escaping could it be something to do with that?
I understand, the way you formulated the question was a bit tricky, anyhow I doubt it has anything to do with escaping user input, it looks more like an issue on the rdbms side.
Try this and post back the output:
$email = mysql_escape_string($_POST['email']);
$random1 = mysql_escape_string($_POST['verify']);
$username = mysql_escape_string($_POST['username']);
$password = mysql_escape_string($_POST['password']);
$usernamebb = mysql_escape_string($_POST['usernamebb']);
$passwordbb = mysql_escape_string($_POST['passwordbb']);
$about = mysql_escape_string($_POST['about']);
$paypal = mysql_escape_string($_POST['paypal']);
$date = date("D M d, Y g:i a");
if ((!ereg("@",$email)) || (!ereg(".",$email))){
$status = "Invalid Email address! Make sure you have entered your email correctly.";
}elseif($username == null){
$status = 'A username is required';
}elseif(($password == null) || (strlen($password) < 4)){
$status = 'A password must be more than 4 characters but can be very large if you want it to be.';
}elseif($random1 == null){
$status = 'Enter the verification code.';
}elseif($date == null){
$status = 'Sorry the server can\'t tell the time therefore you can\'t register right now';
}else{
session_start();
$random = trim($random1);
$validationa = $_SESSION['random'];
if ($validationa != $random){
$status = "Error with verification code";
}else{
if(isset($usernamebb) && isset($passwordbb)){
//Some phpbb3 goes here. Not relevant.
$validation = login_db($usernamebb, $passwordbb);
$valid = $validation['status'];
if(!($valid == 3) || ($valid == 1) || ($valid == 2)){
$phperror = 3;
if($valid == 11){
$status = 'Sorry wrong phpbb3 password';
}
if($valid == 13){
$status = 'Too many attempts. Please wait a while';
}
if($valid == 10){
$status = 'Sorry the phpbb3 username you specified wasn\'t found in the database';
}else{
$status = 'Error: The server doesn\'t like you. Error code ' . $valid;
};
}
}else{
$usernamebb = 0;
$passwordbb = 0;
}
if($phperror != 3){
$link = mysql_connect("localhost","godofgod_p_bb1","password");
mysql_select_db(godofgod_p_bb1, $link) or die( "CRITICAL ERROR! Please try again! Error: Unable to select database. If the problem persists please contact god0fgod imediately.");
$query="INSERT INTO users VALUES ('$username','$password','','$about','$email','','','$paypal','','$usernamebb','$date','','','','','','')";
$result = mysql_query($query);
echo mysql_errno($link) . ": " . mysql_error($link) . "\n";
mysql_close();
$status = 'Success. You can now login with your username and password.';
}
}
}
By the way, you may also want to look into better ways to validate $email, your current validation routine is quite inefficient. Have a look at preg_match() and search google for a decent pattern.
