Right I first made the code a bit easier to read and debug
<?php
require_once("db/connect.php");
session_start();
//Declare Variables
$Username = $_POST['username'];
$Email = $_POST['email'];
$Email1 = "@";
$Email_Check = strpos($Email,$Email1);
$Password = sha1($_POST['password']);
$Re_Password = sha1($_POST['re-password']);
$formErrors = array();
if (!empty($_POST['Submit']))
{
//Check To See If All Information Is Correct
if($Email == "")
{
$formErrors['email'] = "You have not entered your email!";
}
elseif($Email_Check === false)
{
$formErrors['checkemail'] = "Your email is incorrect!";
//Check to see if the email address is already in use
$email_add = mysql_query("SELECT * FROM users WHERE email='$Email'");
if (mysql_num_rows($email_add) > 0)
{
$formErrors['checkemail2'] = "That email is already in use";
}
}
if ($Username == "")
{
$formErrors['username'] = "You didn't enter a username!";
}
else
{
//Check to see if the username is already in use
$user = mysql_query("SELECT * FROM users WHERE username='$Username'");
if (mysql_num_rows($user) > 0)
{
$formErrors['checkuser'] = "That username is already taken";
}
}
if($Password == "" || $Re_Password == "")
{
$formErrors['password'] = "You didn't enter a password!";
}
elseif($Password != $Re_Password)
{
$formErrors['repeatpass'] = "Your passwords don't match!";
}
if (count($formErrors) == 0)
{
//Insert Into Database
if(!mysql_query("INSERT INTO users (email, username, password) VALUES ('$Email', '$Username', '$Password')"))
{
die("We could not register you due to a error (Contact the website owner if this continues to happen.)");
}
else
{
die("User Created");
}
}
else
{
$startError = '<div class="formError"><p><img src="" width="16" height="16">Please check the follwing:</p><ul>';
foreach ($formErrors as $error)
{
$startError .= "<li>$error</li>";
}
$startError .='</ul></div>';
}
}
?>
I not had time to test the code to see if it works but I can say something:
<?php echo sha1(''); ?>
Will output: da39a3ee5e6b4b0d3255bfef95601890afd80709 this means
<?php
if($Password == "" || $Re_Password == "")
{
$formErrors['password'] = "You didn't enter a password!";
}
?>
will never be true so people can infact post empty password.
Also, checking your form code you sending the form to reg_process.php I will assume that the above code is from reg_process.php and no where in reg_process.php do you output $formErrors.
I would do something in line with this (signup.php):
<?php
// Here we process the form:
$username = (isset($_POST['username'])) ? $_POST['username'] : '';
// If form been submitted
if ( isset($_POST['Submit']) )
{
if ( empty($username) )
{
$error['username'] = "Missing username";
}
if ( !isset($error) )
{
// No error found
// insert the user
echo 'Signup complete';
exit;
}
}
?>
<html>
<head></head>
<body>
<?php
// If error found
if ( isset($error) ) {
// Loop errors
foreach($error AS $e) {
echo $e . "<br />";
}
}
?>
<form action="signup.php" method="post">
Username: <input type="text" name="username" /> <br />
<input type="submit" name="Submit" value="Sign up" />
</form>
</body>
</html>
