Hi,
I would be incredibly grateful for any help as I have taken this as far as I am able and am now in a position where I am just confused by all the different methods I have seen. I have my HTML form and I am sending my information to the insertinto form and am trying to validate, sanitize and prevent injections before the data is put into the database. At the moment it is a mess and not working, all I get is the first response, "Please enter a firstname" even if I have entered a firstname.
Please could someone help me with:
1. What am I doing wrong (I think my code is becoming worse each time I try to solve the problem)?
2. Am I doing everything to protect my code and database, I hear people mentioning MD5 but have no idea what it is. Should I being this or anything else in addition to what is involved?
The code is:
<html>
<head>
</head>
<body>
<?php
$filters=array
(
"fname"=>array
(
"filter"=>FILTER_SANITIZE_STRING
),
"lname"=>array
(
"filter"=>FILTER_SANITIZE_STRING
),
"email"=>FILTER_VALIDATE_EMAIL,
"cemail"=>FILTER_VALIDATE_EMAIL,
"pword"=>array
(
"filter"=>FILTER_SANITIZE_INT,
"options"=>array
(
"min_range"=>1,
"max_range"=>9,
"strlen"=>12
)
),
"cpword"=>array
(
"filter"=>FILTER_SANITIZE_INT,
"options"=>array
(
"min_range"=>1,
"max_range"=>9,
"strlen"=>12
)
),
"dobyear"=>array
(
"filter"=>FILTER_SANITIZE_INT,
"options"=>array
(
"min_range"=>1992
)
),
"natcountry"=>array
(
"filter"=>FILTER_SANITIZE_STRING
),
"rcountry"=>array
(
"filter"=>FILTER_SANITIZE_STRING
),
"postcode"=>array
(
"filter"=>FILTER_SANITIZE_STRING
),
"other"=>array
(
"filter"=>FILTER_SANITIZE_STRING
),
);
$result = filter_input_array(INPUT_GET, $filters);
if (!$result["fname"])
{
echo("Please enter your first name.<br />");return false;
}
elseif (!$result["lname"])
{
echo("Please enter your last name.<br />"); return false;
}
elseif (!$result["email"])
{
echo("Email address is not valid.<br />"); return false;
}
elseif (!$result["cemail"])
{
echo("Your email addresses do not match.<br />"); return false;
}
elseif (!$result["pword"])
{
echo("Please ensure your password includes a number between 0-9.<br />"); return false;
}
elseif (!$result["cpword"])
{
echo("Please ensure your password includes a number between 0-9.<br />"); return false;
}
elseif (!$result["dobyear"])
{
echo("Users must be over 18 years old<br />"); return false;
}
elseif (!$result["natcountry"])
{
echo("Please select your nationality.<br />"); return false;
}
elseif (!$result["rcountry"])
{
echo("Please select your country of residence.<br />"); return false;
}
elseif (!$result["postcode"])
{
echo("Please enter your postcode.<br />"); return false;
}
elseif (!$result["industry"])
{
echo("Please select your industry.<br />"); return false;
}
else
{
return true;
}
if ($fname=='enter firstname')
{
echo("Please enter your first name.<br />");return false;
}
elseif ($lname=='enter surname')
{
echo("Please enter your last name.<br />"); return false;
}
elseif ($email=='enter email address')
{
echo("Email address is not valid.<br />"); return false;
}
elseif ($cemail=='confirm email address' OR $cemail=='!email')
{
echo("Your email addresses do not match.<br />"); return false;
}
elseif ($pword='password')
{
echo("Please ensure your password includes a number between 0-9.<br />"); return false;
}
elseif ($cpword=='password' OR $cpword=='!pword')
{
echo("Please ensure your password includes a number between 0-9.<br />"); return false;
}
elseif ($DOByear=='please select')
{
echo("Users must be over 18 years old<br />"); return false;
}
elseif ($natcountry=='please select')
{
echo("Please select your nationality.<br />"); return false;
}
elseif ($rcountry=='please select')
{
echo("Please select your country of residence.<br />"); return false;
}
elseif ($postcode=='enter postcode')
{
echo("Please enter your postcode.<br />"); return false;
}
elseif ($industry=='please select')
{
echo("Please select your industry.<br />"); return false;
}
else
{
return true;
}
function check_input($value)
{
if (get_magic_quotes_gpc())
{
$value=stripslashes($value);
}
if (!is_numeric($value))
{
$value = "'" . mysql_real_escape_string($value) . "'";
}
return $value;
}
$con = mysql_connect("localhost","user","password");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db("my_db", $con);
$sql="INSERT INTO members(fname, lname, email, cemail, pword, cpword, sex, DOBMonth, DOBDay, DOBYear, natcountry, rcountry, postcode, industry, other, date)
VALUES
('$_POST[fname]','$_POST[lname]','$_POST[email]','$_POST[cemail]','$_POST[pword]','$_POST[cpword]','$_POST[sex]','$_POST[DoBMonth]','$_POST[DOBDay]','$_POST[DoBYear]','$_POST[sex]','$_POST[ncountry]','$_POST[postcode]','$_POST[industry]','$_POST[other]','$_GET[CURDATE]')";
if (!mysql_query($sql,$con))
{
die('Error: ' . mysql_error);
}
mysql_close($con);
?>
</body>
</html>
