Hi,
I try this code
//check for unique name
$check1 = mysql_query("SELECT * FROM $tbl_name WHERE username= '".$_POST['username']."'");
if (!$check1)
{
echo mysql_error();
}
else
{
$check2 = mysql_fetch_object($check1);
var_dump($check2);
if(!is_object($check2))
{
echo"check2 is not an object";
}
}
The message "check 2 is not an object" appear. So it is verified that $check2 is not an object. How can I fix this?
It's also important to note two things: first, your code is vulnerable to SQL Injection; and second, the MySQL extension is deprecated.
I am new to php. Do I need to also prevent this on the registration form as I already use the code below in my login.php
// To protect MySQL injection
$membername = stripslashes($membername);
$memberpass = stripslashes($memberpass);
$memberemail= stripslashes($memberemail);
$membername = mysql_real_escape_string($membername);
$memberpass = mysql_real_escape_string($memberpass);
$memberemail= mysql_real_escape_string($memberemail);
This is my full code to process the registration
<?php
$server="localhost"; // Host name
$username=""; // Mysql username
$password=""; // Mysql password
$db_name="test_db"; // Database name
$tbl_name="test"; // Table name
//Connect to server
mysql_connect("$server", "$username", "$password")or die("cannot connect to server");
//Connect to database
mysql_select_db("$db_name")or die("cannot select database");
if(isset($_POST['register']))
{
//USERNAME CHECKING
if(!$_POST['username'])
{
die('Username is empty');
}
else
{
//check for invalid character
$invalid=array('.',',','/','\\',"'",';','[',']','-','_','*','&','^', '%','$','#','@','!','~','+','(',')','|','{','}','<','>','?',':','"','=');
//length of username
$length = strlen($_POST['username']);
//replace invalid characters
$_POST['username'] = str_replace($invalid, '', $_POST['username']);
$test = $_POST['username'];
//if lenghts are different ($len smaller), invalid characters found, so prompt error.
if(strlen($test) != $length)
{
die('Username Error: Username contained invalid characters. You can only use A-Z, 0-9 and the underscore (_).');
}
else
{
//check for unique name
$check1 = mysql_query("SELECT * FROM $tbl_name WHERE username= '".$_POST['username']."'");
if (!$check1)
{
echo mysql_error();
}
else
{
$check2 = mysql_fetch_object($check1);
var_dump($check2);
if(!is_object($check2))
{
echo"check2 is not an object";
}
}
$check1 = mysql_query("SELECT * FROM $tbl_name WHERE username= '".$_POST['username']."'");
if (!$check1)
{
echo mysql_error();
}
else
{
$check2 = mysql_fetch_object($check1);
if($check2->username == $_POST['username'])
{
die('Sorry but username "'.$check2->username.'" is taken');
}
else
{
//PASSWORD CHECKING
if(!$_POST['password'])
{
die('Error: Password field was blank');
}
else
{
if(!$_POST['verifypassword'])
{
die('Error: Verify Password field was blank.');
}
else
{
if($_POST['password'] != $_POST['verifypassword'])
{
die('Error: The passwords do not match.');
}
else
{
if(strlen($_POST['password']) < 6 )
{
die('Error: Your password is too short. Must be 6 or more characters in length.');
}
else
{
//EMAIL CHECKING
if(!$_POST['email'])
{
die('Error: Email field was blank');
}
else
{
//check for invalid character
$emailinvalid=array(',','/','\\',"'",';','[',']','-','_','*','&','^', '%','$','#','!','~','+','(',')','|','{','}','<','>','?',':','"','=');
//length of username
$emaillength = strlen($_POST['email']);
//replace invalid characters
$_POST['email'] = str_replace($emailinvalid, '', $_POST['email']);
$emailcheck = $_POST['email'];
//if lenghts are different ($len smaller), invalid characters found, so prompt error.
if(strlen($emailcheck) != $emaillength)
{
die('Email Error: Email contained invalid characters.');
}
else
{
$insertuser="INSERT INTO $tbl_name (username, password,email) VALUE('".$_POST['username']."','".md5($_POST['password'])."','".$_POST['email']."')";
$insertuser2=mysql_query($insertuser);
if(!$insertuser2)
{
die(mysql_error());
}
else
{
echo "Registration Succesful";
echo "<br><a href=login.html>Click Here</a> to login to your account";
}
}
}
}
}
}
}
}
}
}
}
}
else
{
}
?>
Does my code still vulnerable to SQL injection even if I already put some parameter?
