Hello all, I am currently teaching my self MySQL by making a Dummy user registration and login system. However, when ever I register a dummy account, it always bypasses the blocks I put in place! (i.e. not NULL, not too long, check for dupe's, etc.)
When it runs, I skips right to "thankyou.html"
It does also insert the data into my temp table (even it i fill in only 1 field, or none)
Here is my Code
Keep in mind, I'm new to this PHP stuff, sarted only a week or so back.
<?php
// PRE DEFINE VARS
$username = strip_tags($_POST['username']);
$password1 = strip_tags($_POST['password1']);
$password2 = strip_tags($_POST['password2']);
$email1 = strip_tags($_POST['email1']);
$email2 = strip_tags($_POST['email2']);
$firstname = strip_tags($_POST['firstname']);
$lastname = strip_tags($_POST['lastname']);
// MySQL VARS
$host = "localhost";
$sql_username = "xxx";
$sql_password = "xxx";
$database = "xxx";
// CONNECT TO THE SERVER
$connect = mysql_connect($host, $sql_username, $sql_password);
if($connect) {
// SELECT THE DATABASE
$db_select = mysql_select_db($database, $connect);
if($db_select) {
// CHECK MATCHING EMAILS AND PASSWORDS
if($password1 == $password2 && $email1 == $email2) {
$email = $email1;
$password = $password1;
// CHECK FOR EMPTY FIELDS
if(strlen($password) != NULL || strlen($username) != NULL || strlen($email) != NULL || strlen($firstname) != NULL || strlen($lastname) != NULL) {
// CHECK FOR LONG FIELDS
if(strlen($password) < '20' || strlen($username) < '14' || strlen($email) < '50' || strlen($firstname) < '50' || strlen($lastname) < '50') {
// CHECK FOR DUPE USERS IN USERS TABLE
$query = "SELECT * FROM users WHERE username='$username' OR email='$email'";
$result = mysql_query($query);
$num = mysql_num_rows($result);
if($num == '0') {
// CHECK FOR DUPE USERS IN TEMP TABLE
$query = "SELECT * FROM temp WHERE username='$username' OR email='$email'";
$result = mysql_query($query);
$num = mysql_num_rows($result);
if($num == '0') {
// ENCRYPT PASSWORD WITH MD5
$h_password = md5($password);
// MAKE EMAIL CONFIRMATION CODE
$confirm_code = md5(uniqid(rand()));
// STORE TEMP DATA
$sql = "INSERT INTO temp SET code='$confirm_code', username='$username', password='$h_password', email='$email', firstname='$firstname', lastname='$lastname'";
$result = mysql_query($sql);
// EMAIL CONFRIMATION CODE
if($result) {
$message="Your Comfirmation Link! \r\n";
$message.="Click on this link to activate your account \r\n";
$message.="http://fisherevans.getfrantic.com/test_login/confirm.php?passkey=$confirm_code";
$messgae.=" ";
$messgae.="Username : $username";
$messgae.="Password : $password";
$sentmail=mail("$email",'Registration Confrimation',"$message");
// SEND TO THANKYOU PAGE
header( 'Location: thankyou.html' );
} else {
header( 'Location: login.php?action=register&error=6' );
die();
}
} else {
header( 'Location: login.php?action=register&error=5' );
die();
}
} else {
header( 'Location: login.php?action=register&error=4' );
die();
}
} else {
header( 'Location: login.php?action=register&error=3' );
die();
}
} else {
header( 'Location: login.php?action=register&error=2' );
die();
}
} else {
header( 'Location: login.php?action=register&error=1' );
die();
}
} else {
die('Could not Connect to the selected Database! ' . mysql_error());
}
} else {
die('Could not Connect to the server! ' . mysql_error());
}
?>
PS : It connects fine to the DB and TABLE
PSS : Any advice to make this more secure, would be greatly appreciated 😃
