$HTTP_POST_VARS help needed from a noob

[databear]

Hi all,

I am getting the following error when running my page:

Notice: Undefined variable: HTTP_POST_VARS in (location of file) on line 108

here are the relevant PHP code for this file:

<?php include('./include/admin.php'); ?>
<?php include('./include/debug_helper.php'); ?>
<?php $debug = true; ?>
<?php
function insert_data($formdata)
{
// Insert Data into users table
// $formdata = form array

// Set up database connection variables
$error = "";
$myhost = "localhost";
$myuser = "user";
$mypassword = "pass";
$mydb = "bagsbookings";

// Set up data to insert
$username = $formdata['username'];
$password = $formdata['password'];
$status = $formdata['status'];

// Encrypt password using the key "my_key_here"
$password = crypt($password,"my_key_here");

// Connect to mySQL server
$mysql = @mysql_connect($myhost, $myuser, $mypassword);
if (!$mysql)
{
$error = "Cannot connect to mySQL server";
return ($error);
}

// Connect to Database
$mysqldb = @mysql_select_db($mydb, $mysql);
if (!$mysqldb)
{
$error = "Cannot open database";
return($error);
}

// Insert Data
$myquery = "INSERT INTO tbl_users ( username, password, status) VALUES ('$username', '$password', '$status')";
$result = mysql_query($myquery, $mysql);
if (!$result)
{
$error = "Cannot run query";
return($error);
}

// Return true if record written successfully
return("true");
}
?>
<?php
function verify_data($formdata)
{
// This function uses the functions in the include file
// and uses them to validate various aspects of the form.
// If validation fails, it returns $error, the appropriate error message
// If validation suceeds, return true
$error = "";
$form_data = trim_data($formdata);
$user = $form_data['username'];

// check all form fields are filled in
if (!check_form($form_data))
{
$error = "All Form Fields MUST be filled in";
return($error);
}

// Check password and confirmation password match
if (!confirm_password($form_data, 'password', 'confirmpassword'))
{
$error = "Password and Confirms password do not match";
return($error);
}

// Check password length
if(!check_password_length($form_data, 'password', 5));
{
$error = "Password should be more than 5 characters long";
return($error);
}

// Check that username is unique
$check = check_unique($user, 'bagsbookings', 'localhost', 'user', 'pass', 'tbl_users', 'username');
if ($check != "true")
{
$error = "Username is already in use, select another";
return($error);
}

// If validated successfully, insert data into table
$insert_check = insert_data($formdata);

// If error with insertion, return error
if($insert_check != "true")
return($insert_check);

// Form validated and record inserted successfully
return("");
}
?>
<?php
// Main code - Verifies the form data, and inserts into
// users table in the database
if($HTTP_POST_VARS["submit"]=="Create User"){
$error = verify_data($HTTP_POST_VARS);
if ($error == "")
$success = "User inserted successfully";
}
?>

Here is the HMTL code for the form that runs the code:

       <p>&nbsp;</p>
          <p><?php echo($error); ?>
              <?php echo($success); ?>
          </p>
        <h4>Create New User</h4>
       <form name="createuser" method="post" action="<?php echo($PHP_SELF) ?>">
           <p align="center">Enter new user details here: </p>
            <table width="200" border="1">
              <tr>
                <td>Username:</td>
                <td><div align="center">
                  <input name="username" type="text" id="username" maxlength="45"  >
                </div></td>
              </tr>
              <tr>
                <td>Password: </td>
                <td><div align="center">
                  <input name="password" type="password" id="password" maxlength"80">
                </div></td>
              </tr>
              <tr>
                <td>Confirm Password:</td>
                <td><div align="center">
                  <input name="confirmpassword" type="password" id="confirmpassword" maxlength="80" >
                </div></td>
              </tr>
              <tr>
                <td>User Status:</td>
                <td><div align="center">
                  <select name="status" id="status">
                    <option value="admin">Admin</option>
                    <option value="staff" selected>Staff</option>
                  </select>
                </div></td>
              </tr>
            </table>
            <p align="center">
              <input type="submit" name="Submit" value"Create User" >
            </p>
        </form>
        <p>&nbsp;</p>
        <?php 
   debuginfo($HTTP_POST_VARS, "formdata", 42);
  ?>

This form is used for creating a new user on my website, well it would if it worked 😕

I am using PHP5.2.5 with Apache 2.2.8 on a Microsoft Vista Business PC

This is my first piece of programming with PHP so your help will be greatly appreciated.

Many thanks in advance

Databear

[bradgrafelman]

I removed the MySQL login credentials and your crypt key from your post - you might want to keep such data private and not share it with the world. 😉

As for your problem, the $HTTP*VARS variables have long since been deprecated and, as you have discovered, are disabled by default. Instead, you should be using the superglobal arrays such as $_POST - more info can be found on this manual page: [man]variables.superglobals[/man].

Also, variables such as $PHP_SELF don't exist either (a remnant of register_globals, I believe). For PHP_SELF, you can use $_SERVER['PHP_SELF'].

Finally, it appears as though you are vulnerable to SQL injection attacks. User-supplied data should never be placed directly into a SQL query. Instead, you should first sanitize it with a function such as [man]mysql_real_escape_string/man.