User registration

[Denholm]

Hello everyone. This is my first attempt at creating a user registration script. The script works, I have tested it and it places all the sanitized data into the database properly. I'm finished sprucing up the code, but I know there has to be a more efficient method of doing what I did. There may even be some security steps I missed. Therefore I'm looking for your opinion. What do you think about the code? What would you do differently? What would you change or add to make this script more secure?

It is quite long, as I'm verifying a lot of user input. I placed the words, "censored" on information I feel shouldn't be posted here.

<?php
session_start();

$remram = "unset($_SESSION\[\'*censored*\'\])";
$dest = "session_destroy()";

if(isset($_SESSION['*censored*'])){
    if($_SESSION['*censored*'] == 2212) {
unset($_SESSION['*censored*']);

#Start of user input verification.

if($_POST['*censored*'] == "") {
    $_SESSION['*censored*'] = "pos";
} else { $_SESSION['save1'] = $_POST['*censored*'];
}
if($_POST['*censored*'] == "") {
} else {$_SESSION['save10'] = $_POST['*censored*'];
}
if($_POST['*censored*'] == "") {
    $_SESSION['*censored*'] = "pos";
} else { $_SESSION['save2'] = $_POST['*censored*'];
}
if($_POST['*censored*'] == "") {
    $_SESSION['*censored*'] = "pos";
} else { $_SESSION['save3'] = $_POST['*censored*'];
}
if($_POST['*censored*'] == "") {
} else { $_SESSION['save11'] = $_POST['*censored*'];
}
if($_POST['*censored*'] == "") {
    $_SESSION['*censored*'] = "pos";
} else { $_SESSION['save4'] = $_POST['*censored*'];
}
if($_POST['*censored*'] == "") {
    $_SESSION['*censored*'] = "pos";
} else { $_SESSION['save5'] = $_POST['*censored*'];
}
if($_POST['*censored*'] == "") {
    $_SESSION['*censored*'] = "pos";
} elseif($_POST['*censored*'] === "United States") {
} elseif($_POST['*censored*'] === "United Kingdom") {
} # -- A --
elseif($_POST['*censored*'] === "Afghanistan") {
} elseif($_POST['*censored*'] === "Albania") {
} elseif($_POST['*censored*'] === "Algeria") {
} elseif($_POST['*censored*'] === "Andorra") {
} elseif($_POST['*censored*'] === "Angola") {
} elseif($_POST['*censored*'] === "Antigua and Barbuda") {
} elseif($_POST['*censored*'] === "Argentina") {
} elseif($_POST['*censored*'] === "Armenia") {
} elseif($_POST['*censored*'] === "Australia") {
} elseif($_POST['*censored*'] === "Austria") {
} elseif($_POST['*censored*'] === "Azerbaijan") {
} # -- B --
elseif($_POST['*censored*'] === "Bahamas") {
} elseif($_POST['*censored*'] === "Bahrain") {
} elseif($_POST['*censored*'] === "Bangladesh") {
} elseif($_POST['*censored*'] === "Barbados") {
} elseif($_POST['*censored*'] === "Belarus") {
} elseif($_POST['*censored*'] === "Belgium") {
} elseif($_POST['*censored*'] === "Belize") {
} elseif($_POST['*censored*'] === "Benin") {
} elseif($_POST['*censored*'] === "Bhutan") {
} elseif($_POST['*censored*'] === "Bolivia") {
} elseif($_POST['*censored*'] === "Bosnia and Herzegovina") {
} elseif($_POST['*censored*'] === "Botswana") {
} elseif($_POST['*censored*'] === "Brazil") {
} elseif($_POST['*censored*'] === "Brunei Darussalam") {
} elseif($_POST['*censored*'] === "Bulgaria") {
} elseif($_POST['*censored*'] === "Burkin Faso") {
} elseif($_POST['*censored*'] === "Burma") {
} elseif($_POST['*censored*'] === "Burundi") {
} # -- C --
elseif($_POST['*censored*'] === "Cambodia") {
} elseif($_POST['*censored*'] === "Cameroon") {
} elseif($_POST['*censored*'] === "Canada") {
} elseif($_POST['*censored*'] === "Cape Verde") {
} elseif($_POST['*censored*'] === "Central African Republic") {
} elseif($_POST['*censored*'] === "Chad") {
} elseif($_POST['*censored*'] === "Chile") {
} elseif($_POST['*censored*'] === "China") {
} elseif($_POST['*censored*'] === "Colombia") {
} elseif($_POST['*censored*'] === "Comoros") {
} elseif($_POST['*censored*'] === "Congo (Brazzaville)") {
} elseif($_POST['*censored*'] === "Congo (Kinshasa)") {
} elseif($_POST['*censored*'] === "Costa Rica") {
} elseif($_POST['*censored*'] === "Cote d'lvoire") {
} elseif($_POST['*censored*'] === "Croatia") {
} elseif($_POST['*censored*'] === "Cuba") {
} elseif($_POST['*censored*'] === "Cyprus") {
} elseif($_POST['*censored*'] === "Czech Republic") {
} # -- D --
elseif($_POST['*censored*'] === "Denmark") {
} elseif($_POST['*censored*'] === "Djibouti") {
} elseif($_POST['*censored*'] === "Dominica") {
} elseif($_POST['*censored*'] === "Dominican Republic") {
} # -- E --
elseif($_POST['*censored*'] === "Ecuador") {
} elseif($_POST['*censored*'] === "Egypt") {
} elseif($_POST['*censored*'] === "El Salvador") {
} elseif($_POST['*censored*'] === "Equatorial Guinea") {
} elseif($_POST['*censored*'] === "Eritrea") {
} elseif($_POST['*censored*'] === "Estonia") {
} elseif($_POST['*censored*'] === "Ethiopia") {
} # -- F --
elseif($_POST['*censored*'] === "Fiji") {
} elseif($_POST['*censored*'] === "Finland") {
} elseif($_POST['*censored*'] === "France") {
} # -- G --
elseif($_POST['*censored*'] === "Gabon") {
} elseif($_POST['*censored*'] === "The Gambia") {
} elseif($_POST['*censored*'] === "Georgia") {
} elseif($_POST['*censored*'] === "Germany") {
} elseif($_POST['*censored*'] === "Ghana") {
} elseif($_POST['*censored*'] === "Greece") {
} elseif($_POST['*censored*'] === "Grenada") {
} elseif($_POST['*censored*'] === "Guatemala") {
} elseif($_POST['*censored*'] === "Guinea") {
} elseif($_POST['*censored*'] === "Guinea-Bissau") {
} elseif($_POST['*censored*'] === "Guyana") {
} # -- H --
elseif($_POST['*censored*'] === "Haiti") {
} elseif($_POST['*censored*'] === "Holy See") {
} elseif($_POST['*censored*'] === "Honduras") {
} elseif($_POST['*censored*'] === "Hong Kong") {
} elseif($_POST['*censored*'] === "Hungary") {
} # -- I --
elseif($_POST['*censored*'] === "Iceland") {
} elseif($_POST['*censored*'] === "India") {
} elseif($_POST['*censored*'] === "Indonesia") {
} elseif($_POST['*censored*'] === "Iran") {
} elseif($_POST['*censored*'] === "Iraq") {
} elseif($_POST['*censored*'] === "Ireland") {
} elseif($_POST['*censored*'] === "Israel") {
} elseif($_POST['*censored*'] === "Italy") {
} # -- J --
elseif($_POST['*censored*'] === "Jamaica") {
} elseif($_POST['*censored*'] === "Japan") {
} elseif($_POST['*censored*'] === "Jordan") {
} # -- K --
elseif($_POST['*censored*'] === "Kazakhstan") {
} elseif($_POST['*censored*'] === "Kenya") {
} elseif($_POST['*censored*'] === "Kiribati") {
} elseif($_POST['*censored*'] === "North Korea") {
} elseif($_POST['*censored*'] === "South Korea") {
} elseif($_POST['*censored*'] === "Kosovo") {
} elseif($_POST['*censored*'] === "Kuwait") {
} elseif($_POST['*censored*'] === "Kyrgystan") {
} # -- L --
elseif($_POST['*censored*'] === "Laos") {
} elseif($_POST['*censored*'] === "Latvia") {
} elseif($_POST['*censored*'] === "Lebanon") {
} elseif($_POST['*censored*'] === "Lesotho") {
} elseif($_POST['*censored*'] === "Liberia") {
} elseif($_POST['*censored*'] === "Libya") {
} elseif($_POST['*censored*'] === "Lichtenstein") {
} elseif($_POST['*censored*'] === "Lithuania") {
} elseif($_POST['*censored*'] === "Luxembourg") {
} # -- M --
elseif($_POST['*censored*'] === "Macau") {
} elseif($_POST['*censored*'] === "Macedonia") {
} elseif($_POST['*censored*'] === "Madagascar") {
} elseif($_POST['*censored*'] === "Malawi") {
} elseif($_POST['*censored*'] === "Malaysia") {
} elseif($_POST['*censored*'] === "Maldives") {
} elseif($_POST['*censored*'] === "Mali") {
} elseif($_POST['*censored*'] === "Malta") {
} elseif($_POST['*censored*'] === "Marshall Islands") {
} elseif($_POST['*censored*'] === "Mauritania") {
} elseif($_POST['*censored*'] === "Mauritius") {
} elseif($_POST['*censored*'] === "Mexico") {
} elseif($_POST['*censored*'] === "Micronesia") {
} elseif($_POST['*censored*'] === "Moldova") {
} elseif($_POST['*censored*'] === "Monaco") {
} elseif($_POST['*censored*'] === "Mongolia") {
} elseif($_POST['*censored*'] === "Montenegro") {
} elseif($_POST['*censored*'] === "Morocco") {
} elseif($_POST['*censored*'] === "Mozambique") {
} # -- N --
elseif($_POST['*censored*'] === "Namibia") {
} elseif($_POST['*censored*'] === "Nauru") {
} elseif($_POST['*censored*'] === "Nepal") {
} elseif($_POST['*censored*'] === "Netherlands") {
} elseif($_POST['*censored*'] === "Netherlands Antilles") {
} elseif($_POST['*censored*'] === "New Zealand") {
} elseif($_POST['*censored*'] === "Nicaragua") {
} elseif($_POST['*censored*'] === "Niger") {
} elseif($_POST['*censored*'] === "Nigeria") {
} elseif($_POST['*censored*'] === "Norway") {
} # -- O --
elseif($_POST['*censored*'] === "Oman") {
} # -- P --
elseif($_POST['*censored*'] === "Pakistan") {
} elseif($_POST['*censored*'] === "Palau") {
} elseif($_POST['*censored*'] === "Palestinian Territories") {
} elseif($_POST['*censored*'] === "Panama") {
} elseif($_POST['*censored*'] === "Papua New Guinea") {
} elseif($_POST['*censored*'] === "Paraguay") {
} elseif($_POST['*censored*'] === "Peru") {
} elseif($_POST['*censored*'] === "Philippines") {
} elseif($_POST['*censored*'] === "Poland") {
} elseif($_POST['*censored*'] === "Portugal") {

End of Part 1

[Denholm]

Part 2:

} # -- Q --
elseif($_POST['*censored*'] === "Qatar") {
} # -- R --
elseif($_POST['*censored*'] === "Romania") {
} elseif($_POST['*censored*'] === "Russia") {
} elseif($_POST['*censored*'] === "Rwanda") {
} # -- S --
elseif($_POST['*censored*'] === "Saint Kitts and Nevis") {
} elseif($_POST['*censored*'] === "Saint Lucia") {
} elseif($_POST['*censored*'] === "Saint Vincent and the Grenadines") {
} elseif($_POST['*censored*'] === "Samoa") {
} elseif($_POST['*censored*'] === "San Marino") {
} elseif($_POST['*censored*'] === "Sao Tome and Principe") {
} elseif($_POST['*censored*'] === "Saudi Arabia") {
} elseif($_POST['*censored*'] === "Senegal") {
} elseif($_POST['*censored*'] === "Serbia") {
} elseif($_POST['*censored*'] === "Seychelles") {
} elseif($_POST['*censored*'] === "Sierra Leone") {
} elseif($_POST['*censored*'] === "Singapore") {
} elseif($_POST['*censored*'] === "Slovakia") {
} elseif($_POST['*censored*'] === "Slovenia") {
} elseif($_POST['*censored*'] === "Solomon Islands") {
} elseif($_POST['*censored*'] === "Somalia") {
} elseif($_POST['*censored*'] === "South Africa") {
} elseif($_POST['*censored*'] === "Spain") {
} elseif($_POST['*censored*'] === "Sri Lanka") {
} elseif($_POST['*censored*'] === "Sudan") {
} elseif($_POST['*censored*'] === "Suriname") {
} elseif($_POST['*censored*'] === "Swaziland") {
} elseif($_POST['*censored*'] === "Sweden") {
} elseif($_POST['*censored*'] === "Switzerland") {
} elseif($_POST['*censored*'] === "Syria") {
} # -- T --
elseif($_POST['*censored*'] === "Taiwan") {
} elseif($_POST['*censored*'] === "Tajikistan") {
} elseif($_POST['*censored*'] === "Tanzania") {
} elseif($_POST['*censored*'] === "Thailand") {
} elseif($_POST['*censored*'] === "East Timor (Timor-Leste)") {
} elseif($_POST['*censored*'] === "Timor-Leste") {
} elseif($_POST['*censored*'] === "Togo") {
} elseif($_POST['*censored*'] === "Tonga") {
} elseif($_POST['*censored*'] === "Trinidad and Tobago") {
} elseif($_POST['*censored*'] === "Tunisia") {
} elseif($_POST['*censored*'] === "Turkey") {
} elseif($_POST['*censored*'] === "Turkmenistan") {
} elseif($_POST['*censored*'] === "Tuvalu") {
} # -- U --
elseif($_POST['*censored*'] === "Uganda") {
} elseif($_POST['*censored*'] === "Ukraine") {
} elseif($_POST['*censored*'] === "United Arab Emirates") {
} elseif($_POST['*censored*'] === "Uruguay") {
} elseif($_POST['*censored*'] === "Uzbekistan") {
} # -- V --
elseif($_POST['*censored*'] === "Vanuatu") {
} elseif($_POST['*censored*'] === "Venezuela") {
} elseif($_POST['*censored*'] === "Vietnam") {
} # -- Y --
elseif($_POST['*censored*'] === "Yemen") {
} # -- Z --
elseif($_POST['*censored*'] === "Zambia") {
} elseif($_POST['*censored*'] === "Zimbabwe") {
} else {
    $_SESSION['*censored*'] = "inv";
}
if($_POST['*censored*'] == "") {
    $_SESSION['*censored*'] = "pos";
} elseif($_POST['*censored*'] === "M") {
    $_SESSION['save6'] = $_POST['*censored*'];
} elseif($_POST['*censored*'] === "F") {
    $_SESSION['save6'] = $_POST['*censored*'];
} else {
    $_SESSION['*censored*'] = "pos";
}
if($_POST['*censored*'] == "") {
    $_SESSION['*censored*'] = "pos";
} else { $_SESSION['save7'] = $_POST['*censored*'];
}
if($_POST['*censored*'] == "") {
    $_SESSION['*censored*'] = "pos";
} else { $_SESSION['save8'] = $_POST['*censored*'];
}
if($_POST['*censored*'] == "") {
    $_SESSION['*censored*'] = "pos";
}
if($_POST['*censored*'] == "") {
    $_SESSION['*censored*'] = "pos";
} elseif($_POST['*censored*'] !== $_POST['*censored*']) {
    $_SESSION['*censored*'] = "pos";
} else { }
if($_POST['*censored*'] == "") {
    $_SESSION['*censored*'] = "pos";
} else { $_SESSION['save9'] = $_POST['*censored*'];
}
if($_POST['*censored*'] == "") {
    $_SESSION['*censored*'] = "pos";
} elseif($_POST['*censored*'] !== $_POST['*censored*']) {
    $_SESSION['*censored*'] = "pos";
} else { }

#End of user-input verification.
#Start redirecting if errors were found.

if(isset($_SESSION['*censored*'])) {
    if($_SESSION['*censored*'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['*censored*'])) {
    if($_SESSION['*censored*'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['*censored*'])) {
    if($_SESSION['*censored*'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['*censored*'])) {
    if($_SESSION['*censored*'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['*censored*'])) {
    if($_SESSION['*censored*'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['*censored*'])) {
    if($_SESSION['*censored*'] === "pos") {
        header("location: register.php");
        exit();
    } elseif($_SESSION['*censored*'] === "inv") {
        header("location: register.php");
        exit();
    } else {}
}
if(isset($_SESSION['*censored*'])) {
    if($_SESSION['*censored*'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['*censored*'])) {
    if($_SESSION['*censored*'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['*censored*'])) {
    if($_SESSION['*censored*'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['*censored*'])) {
    if($_SESSION['*censored*'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['*censored*'])) {
    if($_SESSION['*censored*'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['*censored*'])) {
    if($_SESSION['*censored*'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['*censored*'])) {
    if($_SESSION['*censored*'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['*censored*'])) {
    if($_SESSION['*censored*'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['*censored*'])) {
    if($_SESSION['*censored*'] == "pos") {
        header("location: register.php");
        exit();
    }
}

End of Part 2.

[Denholm]

Part 3:

#End of re-routing.
#Remove saved data of forms now that information has been verified.

if(isset($_SESSION['save1'])) {
    unset($_SESSION['save1']);
}
if(isset($_SESSION['save2'])) {
    unset($_SESSION['save2']);
}
if(isset($_SESSION['save3'])) {
    unset($_SESSION['save3']);
}
if(isset($_SESSION['save4'])) {
    unset($_SESSION['save4']);
}
if(isset($_SESSION['save5'])) {
    unset($_SESSION['save5']);
}
if(isset($_SESSION['save6'])) {
    unset($_SESSION['save6']);
}
if(isset($_SESSION['save7'])) {
    unset($_SESSION['save7']);
}
if(isset($_SESSION['save8'])) {
    unset($_SESSION['save8']);
}
if(isset($_SESSION['save9'])) {
    unset($_SESSION['save9']);
}
if(isset($_SESSION['save10'])) {
    unset($_SESSION['save10']);
}
if(isset($_SESSION['save11'])) {
    unset($_SESSION['save11']);
}

#End of removing user-saved data.

include("*censored*");
include("*censored*");

$mysql = mysqli_init();
$mysqli = new mysqli($*censored*, $*censored*, $*censored*, $*censored*);
if (!$mysql) {
    die('mysqli_init failed');
}
if (!$mysql->options(MYSQLI_INIT_COMMAND, 'SET AUTOCOMMIT = 0')) {
    die('Setting MYSQLI_INIT_COMMAND failded');
}
if (!$mysql->real_connect($*censored*, $*censored*, $*censored*, $*censored*)) {
    die('Connect Error (' . mysqli_connect_errno() . ') '
        . mysqli_connect_error());
}
#Enter user data into strings.
$datafield1 = $_POST['*censored*']; #First Name
$datafield2 = $_POST['*censored*']; #Middle Name
$datafield3 = $_POST['*censored*']; #Last Name
$datafield4 = $_POST['*censored*']; #Address 1
$datafield5 = $_POST['*censored*']; #Address 2
$datafield6 = $_POST['*censored*']; #Zip Code
$datafield7 = $_POST['*censored*']; #City
$datafield8 = $_POST['*censored*']; #Country
$datafield9 = $_POST['*censored*']; #Sex
$datafield10 = $_POST['*censored*']; #User Name
$datafield11 = $_POST['*censored*']; #Alias
$datafield12 = $_POST['*censored*']; #Password
$datafield13 = $_POST['*censored*']; #Email
#End of entering user data into strings.

#Set strings to be sanitized.
$cldata = $mysqli->real_escape_string($datafield1);
$cldata0 = $mysqli->real_escape_string($datafield2);
$cldata1 = $mysqli->real_escape_string($datafield3);
$cldata2 = $mysqli->real_escape_string($datafield4);
$cldata3 = $mysqli->real_escape_string($datafield5);
$cldata4 = $mysqli->real_escape_string($datafield6);
$cldata5 = $mysqli->real_escape_string($datafield7);
$cldata6 = $mysqli->real_escape_string($datafield8);
$cldata7 = $mysqli->real_escape_string($datafield9);
$cldata8 = $mysqli->real_escape_string($datafield10);
$cldata9 = $mysqli->real_escape_string($datafield11);
$cldata10 = $mysqli->real_escape_string($datafield12);
$cldata11 = $mysqli->real_escape_string($datafield13);
#End of preparing strings to be sanitized.

$upswdspc = hash('sha384', $cldata10 . SALT);
$sinfo = mysqli_connect($*censored*, $*censored*, $*censored*, $*censored*);

if ($mysqli->query("INSERT INTO *censored* VALUES ('', '$cldata8', '$cldata9', '$upswdspc', '$cldata11', '$cldata7', '$cldata', '$cldata0', '$cldata1', '$cldata2', '$cldata3', '$cldata5', '', '$cldata4', '$cldata6')")) {
    printf("Row inserted.\n", mysqli_affected_rows($sinfo));
}
echo 'SUCCESS! ' . $mysql->host_info . "\n";
$mysql->close();
} else {
    $remram;
    $dest;
    header("location: register.php");
    exit();
}
} else {
$remram;
$dest;
header("location: register.php");
exit();
}
?>

As you can probably see. First the script checks for a session which is set on the registration form. If it is present, the script begins to check if the user entered data. If the user didn't enter data, a session is set. The script also checks if two fields (Confirm password and Confirm Email) match the password and email given. If they don't, a session is set. After all of the sessions are set, a script checks to see if any sessions are set which would return the user to the registration page printing the error(s). Otherwise, sessions which save user-input data are unset allowing the script to continue.

Now that data input has been verified, we place the data into strings. We then get these strings ready to be sanitized. Afterward we hash the sanitized password string and insert the data into the database. Afterward connections to the database are closed and script terminates.

Afterward you may notice the two, "else" statements. These relate to the first part of the script checking for the existence of a session. If the session doesn't exist, the user is redirected to the registration page.

As I mentioned, I think there's a more efficient method for checking this data. I simply don't know what that method might be. If there is no other method, I'm fine with what I have. I would also appreciate some input on the safety of this script (excluding thoughts on SSL, as I'll set that up later).

Looking forward to your ideas.🙂

[Weedpacket]

Denholm wrote:

It is quite long, as I'm verifying a lot of user input.

As far as I can make out (given all the censored field names) you're validating thirteen fields. That's not a lot. The form for editing posts on this page (just the editing form, not the delete or options forms) has more than twice that many.

if(isset($_SESSION['*censored*'])) {
    if($_SESSION['*censored*'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['*censored*'])) {
    if($_SESSION['*censored*'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['*censored*'])) {
    if($_SESSION['*censored*'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['*censored*'])) {
    if($_SESSION['*censored*'] == "pos") {
        header("location: register.php");
        exit();
    }
} 

So you're working for the Fijian news media, then? 😉

Due to all the censorship it's pretty much impossible to tell what's going on, but the rule of thumb is: if you're doing the same thing over and over again, you're doing it wrong. Like, all that checking of country names (whatever that is doing since the branches almost all appear to be empty): surely [man]in_array[/man] would be something to use here? Another note, you can [man]unset[/man] multiple variables at once, and they don't have to be set first.

Denholm wrote:

I placed the words, "censored" on information I feel shouldn't be posted here.

If this is a user registration script, then by definition all those censored POST field names will be visible to nonregistered users but they're too sensitive to be shown here? But this bit:

$datafield1 = $_POST['*censored*']; #First Name
$datafield2 = $_POST['*censored*']; #Middle Name
$datafield3 = $_POST['*censored*']; #Last Name
$datafield4 = $_POST['*censored*']; #Address 1
$datafield5 = $_POST['*censored*']; #Address 2
$datafield6 = $_POST['*censored*']; #Zip Code
$datafield7 = $_POST['*censored*']; #City
$datafield8 = $_POST['*censored*']; #Country
$datafield9 = $_POST['*censored*']; #Sex
$datafield10 = $_POST['*censored*']; #User Name
$datafield11 = $_POST['*censored*']; #Alias
$datafield12 = $_POST['*censored*']; #Password
$datafield13 = $_POST['*censored*']; #Email 

Never mind the daft variable names, what's wrong with using $_POST['first-name'], $_POST['middle-name'], etc.?

Oh, and down at the bottom, there:

$remram;
$dest; 

Those lines don't do anything. Perhaps you want those to be functions.

There's probably more, but I'm not in the mood right now for all the copy-and-pasting and then refactoring it all to the point where it becomes visible.

[Denholm]

I am aware that the post fields will be visible to users. However, when I do publish the website I don't want them to be able to match my post fields to this thread where the source code of my user-input verification script is shown.

The checking of country names is to ensure the user checked one of the options on the drop-down menu (Asking the user to select which country they're located in). If someone managed to bypass the initial $_SESSION verification I wanted to ensure that person couldn't enter false data through the country selection field (This is what I was referring to when I mentioned there had to be a more efficient method).

Thank you for mentioning $remram and $dest. They were originally set to transfer the user to the registration page and destroy any active sessions. I'll take a look at the in_array feature.

Thank you for taking the time to look at it.

[laserlight]

Denholm wrote:

I am aware that the post fields will be visible to users. However, when I do publish the website I don't want them to be able to match my post fields to this thread where the source code of my user-input verification script is shown.

Well, one school of thought is that true security means that even if the attacker has such knowledge, he/she will still be unable to use this knowledge to his/her advantage, thus "security by obscurity" should be avoided. Another school of thought says that obfuscation is a useful additional layer beyond that of true security, and it helps even if it is unnecessary.

[Weedpacket]

Denholm wrote:

I am aware that the post fields will be visible to users. However, when I do publish the website I don't want them to be able to match my post fields to this thread where the source code of my user-input verification script is shown.

This would only matter if the user-input verification script had a security hole for them to find. But wait, you're posting the code to see if anyone can find security holes in it and tell you.

If you do feel compelled to anonymise your form fields, couldn't you at least use distinguishable pseudonyms instead censored censored "censored" censored censored censored?

[djjjozsi]

if you are using static variable names for form elements, your form would be unsecure from attackers or spam bots.
-Use image activation codes,
-send verification codes to the visitor's email address
-encrypt the form variable names (if you think its really needed)
-set an identify code to know the user comes from your form and not a clone one.
-determine the lenght of the posted data

You should not code too much. If you want to know a value selected from a dropdown, you can build an array (mentioned before) and you can use that with in_array() function (example on this page). If the data populated from a database just select it.

[Denholm]

Yes, that makes sense packet. However even the best can miss something sometimes. I'll make a few changes then I'll post it again with less obscurity. Thank you for the information so far. I've got some reading to do.

[Denholm]

Alright, I finally got around to inserting the data into an array. What a difference! not as many, "ifs" any more.

Alright, here's the code (less censoring of course), please excuse the size:

<?php
session_start();

$remram = "unset($_SESSION\[\'*censored*\'\])";
$dest = "session_destroy()";

if(isset($_SESSION['*censored*'])){
    if($_SESSION['*censored*'] == *censored*) {
unset($_SESSION['*censored*']);

#Start of user input verification.

if($_POST['lock1'] == "") {
    $_SESSION['stickem1'] = "pos";
} else { $_SESSION['save1'] = $_POST['lock1'];
}
if($_POST['free1'] == "") {
} else {$_SESSION['save10'] = $_POST['free1'];
}
if($_POST['lock2'] == "") {
    $_SESSION['stickem2'] = "pos";
} else { $_SESSION['save2'] = $_POST['lock2'];
}
if($_POST['lock3'] == "") {
    $_SESSION['stickem3'] = "pos";
} else { $_SESSION['save3'] = $_POST['lock3'];
}
if($_POST['free2'] == "") {
} else { $_SESSION['save11'] = $_POST['free2'];
}
if($_POST['lock4'] == "") {
    $_SESSION['stickem4'] = "pos";
} else { $_SESSION['save4'] = $_POST['lock4'];
}
if($_POST['lock5'] == "") {
    $_SESSION['stickem5'] = "pos";
} else { $_SESSION['save5'] = $_POST['lock5'];
}
#set countries into an array:
$counarr = array("United States", "United Kingdom", "Afghanistan", "Albania", "Algeria", "Andorra", "Angola", "Antigua and Barbuda", "Argentina", "Armenia", "Australia", "Austria", "Azerbaijan", "Bahamas", "Bahrain", "Bangladesh", "Barbados", "Belarus", "Belgium", "Belize", "Benin", "Bhutan", "Bolivia", "Bosnia and Herzegovina", "Botswana", "Brazil", "Brunei Darussalam", "Bulgaria", "Burkin Faso", "Burma", "Burundi", "Cambodia", "Cameroon", "Canada", "Cape Verde", "Central African Republic", "Chile", "China", "Colombia", "Comoros", "Congo (Brazzaville)", "Congo (Kinshasa)", "Costa Rica", "Cote d'Ivoire", "Croatia", "Cuba", "Cyprus", "Czech Republic", "Denmark", "Djibouti", "Dominica", "Dominican Republic", "Ecuador", "Egypt", "El Salvador", "Equatorial Guinea", "Eritrea", "Estonia", "Ethiopia", "Fiji", "Finland", "France", "Gabon", "The Gambia", "Georgia", "Germany", "Ghana", "Greece", "Grenada", "Guatemala", "Guinea", "Guinea-Bissau", "Guyana", "Haiti", "Holy See", "Honduras", "Hong Kong", "Hungary", "Iceland", "India", "Indonesia", "Iran", "Iraq", "Ireland", "Israel", "Italy", "Jamaica", "Japan", "Jordan", "Kazakhstan", "Kenya", "Kiribati", "North Korea", "South Korea", "Kosovo", "Kuwait", "Kyrgyzstan", "Laos", "Latvia", "Lebanon", "Lesotho", "Liberia", "Libya", "Lichtenstein", "Lithuania", "Luxembourg", "Macau", "Macedonia", "Madagascar", "Malawi", "Malaysia", "Maldives", "Mali", "Malta", "Marshall Islands", "Mauritania", "Mauritius", "Mexico", "Micronesia", "Moldova", "Monaco", "Mongolia", "Montenegro", "Morocco", "Mozambique", "Namibia", "Nauru", "Nepal", "Netharlands", "Netherlands Antilles", "New Zealand", "Nicaragua", "Niger", "Nigeria", "Norway", "Oman", "Pakistan", "Palau", "Palestinian Territories", "Panama", "Papua New Guinea", "Paraguay", "Peru", "Philippines", "Poland", "Portugal", "Qatar", "Romania", "Russia", "Rwanda", "Saint Kitts and Nevis", "Saint Lucia", "Saint Vincent and the Grenadines", "Samoa", "San Marino", "Sao Tome and Principe", "Saudi Arabia", "Senegal", "Serbia", "Seychelles", "Sierra Leone", "Singapore", "Slovakia", "Slovenia", "Solomon Islands", "Somalia", "South Africa", "Spain", "Sri Lanka", "Sudan", "Suriname", "Swaziland", "Sweden", "Switzerland", "Syria", "Taiwan", "Tajikistan", "Tanzania", "Thailand", "East Timor (Timor-Leste)", "Timor-Leste", "Togo", "Tonga", "Trinidad and Tobago", "Tunisia", "Turkey", "Turkmenistan", "Tuvalu", "Uganda", "Ukraine", "United Arab Emirates", "Uruguay", "Uzbekistan", "Vanuatu", "Venezuela", "Vietnam", "Yemen", "Zambia", "Zimbabwe");
#countries now in an array.
if($_POST['lock6'] == "") {
    $_SESSION['stickem6'] = "pos";
} elseif(in_array($_POST['lock6'], $counarr)) {
} else {
    $_SESSION['stickem6'] = "inv";
}
if($_POST['lock9'] == "") {
    $_SESSION['stickem14'] = "pos";
} else { $_SESSION['save12'] = $_POST['lock9'];
}
if($_POST['lock7'] == "") {
    $_SESSION['stickem7'] = "pos";
} elseif($_POST['lock7'] === "M") {
    $_SESSION['save6'] = $_POST['lock7'];
} elseif($_POST['lock7'] === "F") {
    $_SESSION['save6'] = $_POST['lock7'];
} else {
    $_SESSION['stickem7'] = "pos";
}
if($_POST['uname'] == "") {
    $_SESSION['stickem8'] = "pos";
} else { $_SESSION['save7'] = $_POST['uname'];
}
if($_POST['aname'] == "") {
    $_SESSION['stickem9'] = "pos";
} else { $_SESSION['save8'] = $_POST['aname'];
}
if($_POST['upswd'] == "") {
    $_SESSION['stickem10'] = "pos";
}
if($_POST['cpswd'] == "") {
    $_SESSION['stickem11'] = "pos";
} elseif($_POST['cpswd'] !== $_POST['upswd']) {
    $_SESSION['uhoh1'] = "pos";
} else { }
if($_POST['lock8'] == "") {
    $_SESSION['stickem12'] = "pos";
} else { $_SESSION['save9'] = $_POST['lock8'];
}
if($_POST['confirm'] == "") {
    $_SESSION['stickem13'] = "pos";
} elseif($_POST['confirm'] !== $_POST['lock8']) {
    $_SESSION['uhoh2'] = "pos";
} else { }

#End of user-input verification.

End of Part 1.

[Denholm]

Part 2:

#Start redirecting if errors were found.

if(isset($_SESSION['stickem1'])) {
    if($_SESSION['stickem1'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['stickem2'])) {
    if($_SESSION['stickem2'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['stickem3'])) {
    if($_SESSION['stickem3'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['stickem4'])) {
    if($_SESSION['stickem4'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['stickem5'])) {
    if($_SESSION['stickem5'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['stickem6'])) {
    if($_SESSION['stickem6'] === "pos") {
        header("location: register.php");
        exit();
    } elseif($_SESSION['stickem6'] === "inv") {
        header("location: register.php");
        exit();
    } else {}
}
if(isset($_SESSION['stickem7'])) {
    if($_SESSION['stickem7'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['stickem8'])) {
    if($_SESSION['stickem8'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['stickem9'])) {
    if($_SESSION['stickem9'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['stickem10'])) {
    if($_SESSION['stickem10'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['stickem11'])) {
    if($_SESSION['stickem11'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['uhoh1'])) {
    if($_SESSION['uhoh1'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['stickem12'])) {
    if($_SESSION['stickem12'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['stickem13'])) {
    if($_SESSION['stickem13'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['uhoh2'])) {
    if($_SESSION['uhoh2'] == "pos") {
        header("location: register.php");
        exit();
    }
}
if(isset($_SESSION['stickem14'])) {
    if($_SESSION['stickem14'] == "pos") {
        header("location: register.php");
        exit();
    }
}

#End of re-routing.

End of Part 2.

[Denholm]

Part 3:

#Remove saved data of forms now that information has been verified.

if(isset($_SESSION['save1'])) {
    unset($_SESSION['save1']);
}
if(isset($_SESSION['save2'])) {
    unset($_SESSION['save2']);
}
if(isset($_SESSION['save3'])) {
    unset($_SESSION['save3']);
}
if(isset($_SESSION['save4'])) {
    unset($_SESSION['save4']);
}
if(isset($_SESSION['save5'])) {
    unset($_SESSION['save5']);
}
if(isset($_SESSION['save6'])) {
    unset($_SESSION['save6']);
}
if(isset($_SESSION['save7'])) {
    unset($_SESSION['save7']);
}
if(isset($_SESSION['save8'])) {
    unset($_SESSION['save8']);
}
if(isset($_SESSION['save9'])) {
    unset($_SESSION['save9']);
}
if(isset($_SESSION['save10'])) {
    unset($_SESSION['save10']);
}
if(isset($_SESSION['save11'])) {
    unset($_SESSION['save11']);
}
if(isset($_SESSION['save12'])) {
    unset($_SESSION['save12']);
}

#End of removing user-saved data.

include("*censored*");
include("*censored*");

$mysql = mysqli_init();
$mysqli = new mysqli($prr1, $att1, $syy1, $duu1);
if (!$mysql) {
    die('mysqli_init failed');
}
if (!$mysql->options(MYSQLI_INIT_COMMAND, 'SET AUTOCOMMIT = 0')) {
    die('Setting MYSQLI_INIT_COMMAND failded');
}
if (!$mysql->real_connect($prr1, $att1, $syy1, $duu1)) {
    die('Connect Error (' . mysqli_connect_errno() . ') '
        . mysqli_connect_error());
}
#Enter user data into strings.
$datafield1 = $_POST['lock1']; #First Name
$datafield2 = $_POST['free1']; #Middle Name
$datafield3 = $_POST['lock2']; #Last Name
$datafield4 = $_POST['lock3']; #Address 1
$datafield5 = $_POST['free2']; #Address 2
$datafield6 = $_POST['lock4']; #Zip Code
$datafield7 = $_POST['lock5']; #City
$datafield8 = $_POST['lock6']; #Country
$datafield9 = $_POST['lock7']; #Sex
$datafield10 = $_POST['uname']; #User Name
$datafield11 = $_POST['aname']; #Alias
$datafield12 = $_POST['upswd']; #Password
$datafield13 = $_POST['lock8']; #Email
$datafield14 = $_POST['lock9']; #State/Province
#End of entering user data into strings.

#Set strings to be sanitized.
$cldata = $mysqli->real_escape_string($datafield1);
$cldata0 = $mysqli->real_escape_string($datafield2);
$cldata1 = $mysqli->real_escape_string($datafield3);
$cldata2 = $mysqli->real_escape_string($datafield4);
$cldata3 = $mysqli->real_escape_string($datafield5);
$cldata4 = $mysqli->real_escape_string($datafield6);
$cldata5 = $mysqli->real_escape_string($datafield7);
$cldata6 = $mysqli->real_escape_string($datafield8);
$cldata7 = $mysqli->real_escape_string($datafield9);
$cldata8 = $mysqli->real_escape_string($datafield10);
$cldata9 = $mysqli->real_escape_string($datafield11);
$cldata10 = $mysqli->real_escape_string($datafield12);
$cldata11 = $mysqli->real_escape_string($datafield13);
$cldata12 = $mysqli->real_escape_string($datafield14);
#End of preparing strings to be sanitized.

$upswdspc = hash('sha384', $cldata10 . SALT);
$sinfo = mysqli_connect($prr1, $att1, $syy1, $duu1);

if ($mysqli->query("INSERT INTO bfmemreg VALUES ('', '$cldata8', '$cldata9', '$upswdspc', '$cldata11', '$cldata7', '$cldata', '$cldata0', '$cldata1', '$cldata2', '$cldata3', '$cldata5', '$cldata12', '$cldata4', '$cldata6')")) {
    printf("Row inserted.\n", mysqli_affected_rows($sinfo));
}
echo 'SUCCESS! ' . $mysql->host_info . "\n";
$mysql->close();
} else {
    $remram;
    $dest;
    header("location: register.php");
    exit();
}
} else {
$remram;
$dest;
header("location: register.php");
exit();
}
?>

End of Part 3.

I'm still considering this to be somewhat, "beta." I simply don't have a comfortable feeling with it that it's actually finished.

[djjjozsi]

if(empty($value1))
$error[]="value1 is empty";

if(empty($value2))
$error[]="value2 is empty";

if(isset($error))
{
$_SESSION["errors"]=$error;
header("Location: register.php");
}

build functions, code less.

[Denholm]

Thanks, I'll experiment with it here in a few minutes.🙂

[Denholm]

Okay, so I used functions to cut down on the code some. Here is what we have now:

Part 1:

<?php
session_start();

$remram = "unset($_SESSION\[\'*censored*\'\])";
$dest = "session_destroy()";

if(isset($_SESSION['*censored*'])){
    if($_SESSION['*censored*'] === *censored*) {
unset($_SESSION['*censored*']);

#Start of user input verification.

if(empty($_POST['lock1'])) {
    $error[1] = "pos";
} else { $save[1] = $_POST['lock1'];
}
if(empty($_POST['free1'])) {
} else { $save[2] = $_POST['free1'];
}
if(empty($_POST['lock2'])) {
    $error[2] = "pos";
} else { $save[3] = $_POST['lock2'];
}
if(empty($_POST['lock3'])) {
    $error[3] = "pos";
} else { $save[4] = $_POST['lock3'];
}
if(empty($_POST['free2'])) {
} else { $save[5] = $_POST['free2'];
}
if(empty($_POST['lock4'])) {
    $error[4] = "pos";
} else { $save[6] = $_POST['lock4'];
}
if(empty($_POST['lock5'])) {
    $error[5] = "pos";
} else { $save[7] = $_POST['lock5'];
}
#set countries into an array:
$counarr = array("United States", "United Kingdom", "Afghanistan", "Albania", "Algeria", "Andorra", "Angola", "Antigua and Barbuda", "Argentina", "Armenia", "Australia", "Austria", "Azerbaijan", "Bahamas", "Bahrain", "Bangladesh", "Barbados", "Belarus", "Belgium", "Belize", "Benin", "Bhutan", "Bolivia", "Bosnia and Herzegovina", "Botswana", "Brazil", "Brunei Darussalam", "Bulgaria", "Burkin Faso", "Burma", "Burundi", "Cambodia", "Cameroon", "Canada", "Cape Verde", "Central African Republic", "Chile", "China", "Colombia", "Comoros", "Congo (Brazzaville)", "Congo (Kinshasa)", "Costa Rica", "Cote d'Ivoire", "Croatia", "Cuba", "Cyprus", "Czech Republic", "Denmark", "Djibouti", "Dominica", "Dominican Republic", "Ecuador", "Egypt", "El Salvador", "Equatorial Guinea", "Eritrea", "Estonia", "Ethiopia", "Fiji", "Finland", "France", "Gabon", "The Gambia", "Georgia", "Germany", "Ghana", "Greece", "Grenada", "Guatemala", "Guinea", "Guinea-Bissau", "Guyana", "Haiti", "Holy See", "Honduras", "Hong Kong", "Hungary", "Iceland", "India", "Indonesia", "Iran", "Iraq", "Ireland", "Israel", "Italy", "Jamaica", "Japan", "Jordan", "Kazakhstan", "Kenya", "Kiribati", "North Korea", "South Korea", "Kosovo", "Kuwait", "Kyrgyzstan", "Laos", "Latvia", "Lebanon", "Lesotho", "Liberia", "Libya", "Lichtenstein", "Lithuania", "Luxembourg", "Macau", "Macedonia", "Madagascar", "Malawi", "Malaysia", "Maldives", "Mali", "Malta", "Marshall Islands", "Mauritania", "Mauritius", "Mexico", "Micronesia", "Moldova", "Monaco", "Mongolia", "Montenegro", "Morocco", "Mozambique", "Namibia", "Nauru", "Nepal", "Netharlands", "Netherlands Antilles", "New Zealand", "Nicaragua", "Niger", "Nigeria", "Norway", "Oman", "Pakistan", "Palau", "Palestinian Territories", "Panama", "Papua New Guinea", "Paraguay", "Peru", "Philippines", "Poland", "Portugal", "Qatar", "Romania", "Russia", "Rwanda", "Saint Kitts and Nevis", "Saint Lucia", "Saint Vincent and the Grenadines", "Samoa", "San Marino", "Sao Tome and Principe", "Saudi Arabia", "Senegal", "Serbia", "Seychelles", "Sierra Leone", "Singapore", "Slovakia", "Slovenia", "Solomon Islands", "Somalia", "South Africa", "Spain", "Sri Lanka", "Sudan", "Suriname", "Swaziland", "Sweden", "Switzerland", "Syria", "Taiwan", "Tajikistan", "Tanzania", "Thailand", "East Timor (Timor-Leste)", "Timor-Leste", "Togo", "Tonga", "Trinidad and Tobago", "Tunisia", "Turkey", "Turkmenistan", "Tuvalu", "Uganda", "Ukraine", "United Arab Emirates", "Uruguay", "Uzbekistan", "Vanuatu", "Venezuela", "Vietnam", "Yemen", "Zambia", "Zimbabwe");
#countries now in an array.
if(empty($_POST['lock6'])) {
    $error[6] = "pos";
} elseif(in_array($_POST['lock6'], $counarr)) {
} else {
    $error[6] = "pos";
}
if(empty($_POST['lock9'])) {
    $error[7] = "pos";
} else { $save[8] = $_POST['lock9'];
}
if(empty($_POST['lock7'])) {
    $error[8] = "pos";
} elseif($_POST['lock7'] === "M") {
    $save[9] = $_POST['lock7'];
} elseif($_POST['lock7'] === "F") {
    $save[10] = $_POST['lock7'];
} else {
    $error[8] = "pos";
}
if(empty($_POST['uname'])) {
    $error[9] = "pos";
} else { $save[11] = $_POST['uname'];
}
if(empty($_POST['aname'])) {
    $error[10] = "pos";
} else { $save[12] = $_POST['aname'];
}
if(empty($_POST['upswd'])) {
    $error[11] = "pos";
}
if(empty($_POST['cpswd'])) {
    $error[12] = "pos";
} elseif($_POST['cpswd'] !== $_POST['upswd']) {
    $error[13] = "pos";
} else { }
if(empty($_POST['lock8'])) {
    $error[14] = "pos";
} else { $save[13] = $_POST['lock8'];
}
if(empty($_POST['confirm'])) {
    $error[15] = "pos";
} elseif($_POST['confirm'] !== $_POST['lock8']) {
    $error[16] = "pos";
} else { }

#End of user-input verification.

End of Part 1.

[Denholm]

Part 2:

#Remove saved data of forms now that information has been verified.

if(isset($save)) {
    unset($save);
}

#End of removing user-saved data.

include("*censored*");
include("*censored*");

$mysql = mysqli_init();
$mysqli = new mysqli($prr1, $att1, $syy1, $duu1);
if (!$mysql) {
    die('mysqli_init failed');
}
if (!$mysql->options(MYSQLI_INIT_COMMAND, 'SET AUTOCOMMIT = 0')) {
    die('Setting MYSQLI_INIT_COMMAND failded');
}
if (!$mysql->real_connect($prr1, $att1, $syy1, $duu1)) {
    die('Connect Error (' . mysqli_connect_errno() . ') '
        . mysqli_connect_error());
}
#Enter user data into strings.
$datafield1 = $_POST['lock1']; #First Name
$datafield2 = $_POST['free1']; #Middle Name
$datafield3 = $_POST['lock2']; #Last Name
$datafield4 = $_POST['lock3']; #Address 1
$datafield5 = $_POST['free2']; #Address 2
$datafield6 = $_POST['lock4']; #Zip Code
$datafield7 = $_POST['lock5']; #City
$datafield8 = $_POST['lock6']; #Country
$datafield9 = $_POST['lock7']; #Sex
$datafield10 = $_POST['uname']; #User Name
$datafield11 = $_POST['aname']; #Alias
$datafield12 = $_POST['upswd']; #Password
$datafield13 = $_POST['lock8']; #Email
$datafield14 = $_POST['lock9']; #State/Province
#End of entering user data into strings.

#Set strings to be sanitized.
$cldata = $mysqli->real_escape_string($datafield1);
$cldata0 = $mysqli->real_escape_string($datafield2);
$cldata1 = $mysqli->real_escape_string($datafield3);
$cldata2 = $mysqli->real_escape_string($datafield4);
$cldata3 = $mysqli->real_escape_string($datafield5);
$cldata4 = $mysqli->real_escape_string($datafield6);
$cldata5 = $mysqli->real_escape_string($datafield7);
$cldata6 = $mysqli->real_escape_string($datafield8);
$cldata7 = $mysqli->real_escape_string($datafield9);
$cldata8 = $mysqli->real_escape_string($datafield10);
$cldata9 = $mysqli->real_escape_string($datafield11);
$cldata10 = $mysqli->real_escape_string($datafield12);
$cldata11 = $mysqli->real_escape_string($datafield13);
$cldata12 = $mysqli->real_escape_string($datafield14);
#End of preparing strings to be sanitized.

$upswdspc = hash('sha384', $cldata10 . SALT);
$sinfo = mysqli_connect($prr1, $att1, $syy1, $duu1);

if ($mysqli->query("INSERT INTO bfmemreg VALUES ('', '$cldata8', '$cldata9', '$upswdspc', '$cldata11', '$cldata7', '$cldata', '$cldata0', '$cldata1', '$cldata2', '$cldata3', '$cldata5', '$cldata12', '$cldata4', '$cldata6')")) {
    printf("Row inserted.\n", mysqli_affected_rows($sinfo));
}
echo 'SUCCESS! ' . $mysql->host_info . "\n";
$mysql->close();
} else {
    $remram;
    $dest;
    header("location: register.php");
    exit();
}
} else {
$remram;
$dest;
header("location: register.php");
exit();
}
?>

End of Part 2.

Thanks djjjozsi, that certainly did cut down on the code.🙂

Anything else that I might be missing which could cause a problem?

[djjjozsi]

<?
if(empty($_POST['lock1'])) {
    $error[1] = "pos";
} else { $save[1] = $_POST['lock1'];
}
if(empty($_POST['free1'])) {
} else { $save[2] = $_POST['free1'];
}
if(empty($_POST['lock2'])) {
    $error[2] = "pos";
} else { $save[3] = $_POST['lock2'];
}
if(empty($_POST['lock3'])) {
    $error[3] = "pos";
} else { $save[4] = $_POST['lock3'];
}
if(empty($_POST['free2'])) {
} else { $save[5] = $_POST['free2'];
}
if(empty($_POST['lock4'])) {
    $error[4] = "pos";
} else { $save[6] = $_POST['lock4'];
}
if(empty($_POST['lock5'])) {
    $error[5] = "pos";
} else { $save[7] = $_POST['lock5'];
} 

?>

this is equal with this:

<?php
include ( "connect.php" );
function empt($args , &$save , &$error){
	$arg=explode("," , $args);
	foreach($arg AS $index)
	{
		if(empty($_POST[$index]))
		$error[]="pos";
		else
		$save[] = $_POST[$index]; 
	}
}

empt("lock1,lock2,lock3,lock4,lock5");
print_r($error)
print_r($save)
?>

[Weedpacket]

// Also useful in other contexts.
$form_field_names = array(
	'lock1',
	'free1',
	'lock2',
	'lock3',
	'free2',
	'lock4',
	'lock5',
	'lock6',
	'lock7',
	'uname',
	'aname',
	'upswd',
	'lock8',
	'lock9'
);
// Only the fields we want
$posted_data = array_intersect_key($_POST, array_flip($form_field_names));

// Array of sanitised strings, keyed by field name
$cldata = array_map(array($mysqli,'real_escape_string'), $posted_data);