Thank you for reading this, I appreciate it and any help you may provide.
So, I have a registration form written in mostly PHP with about 100 lines of code.
Simple enough, it work(ed) fine up until the point I decided to add in a few more extra fields for people to give me more information about themselves.
Like first name, last name, age, gender...etc.
I used the same method of input naming and arrangement as in the previous set of fields, which only included an username, password, password authentication, email, and a checkbox for the T'N'C. The only difference is that the first set was tested (using a combination of !isset() and strlen()) to see if there was missing data, or miss-entered data using things like is_numeral(). The run around, you know.
The password is encrypted using md5() and the rest is fed into a function which then handles the $POST[] variables and displays the results without reloading the page (nifty, eh?). It simply added the md5(), username, and email to the appropriate columns in my mySQL database. It worked perfectly fine, like I said, until I added the few extra columns (after first adding the appropriate columns to mySQL) and values to the end of the query.
$qu = 'INSERT INTO members (name, pass, email, posts, fname, lname, age, gender, locale, phone, im, web, other) VALUES ("$usename","$md5pass","$usemail","0",$usefname","$uselname","$age","$gender","$locale","$phone","$im","$web","$other")'; ###DEFINE QUERY###
return mysql_query($qu, $con);
I run the server using w/AMP, so I'm aware I may have misconfigured mySQL somewhere along the line somehow. I ran a query against the database using the SQL query function in phpMyAdmin, using the same query except replacing the $variables with what would likely be uploaded. (if a $variable from the second set of fields is left unset, it is automatically shifted to 0, which is then interpreted by a PHP script retrieving information as a N/A field. e.g., if phone is 0, then when the member's profile is loaded, PHP reads this and prints "This user has no listed phone number."rather than just a 0, and any other case it prints as is with the necessary hyphens and such, of course.)
Some other potentially helpful tidbits:
usrAddData($_POST['usename'], $_POST['usepass'], $_POST['usemail'], $_POST['usefname'], $_POST['uselname'], $_POST['age'], $_POST['gender'], $_POST['locale'], $_POST['phone'], $_POST['im'], $_POST['web'], $_POST['other']);
$_SESSION['user'] = $usename; ##declared earlier in script
$_SESSION['state'] = 0; ###SET STATUS TO SUCCESS###
pageLoad(); ##a function which has switches and if gates to decide what to display based off the position of 'state'
and
function usrAddData($usename, $usepass, $usemail, $usefname, $uselname, $age, $gender, $locale, $phone, $im, $web, $other){ ###onward to the rest of the code, which i shall not post here, yet -->>
I am aware that this is very insecure as of yet, I do not want to spend 10 minutes writing up the code to check and recheck all of these variables before they are sent and then having to modify the post-send check codes as well, until I am sure they are working.
I know I contradicted one of the first rules of programming, 'always stick to the plan', but I figured, why the hell not?
And now, its giving me a headache.
Any suggestions?
Thanks a bunch, please ask if you need anymore details.