wortmann;11034057 wrote:
localhost...
You'd need a webserver running on localhost if you don't already have it. Prefereably running in the same environment as your production server.
wortmann;11034059 wrote:
I;ve got this php code:
please wrap it in [noparse]
[/noparse] tags. It makes for easier reading.
All data from external sources has to be considered as unsafe. Not all users will provide you with data which is sensible from your perspective, and some will use it to attack you.
wortmann;11034059 wrote:
$name=$_POST['name'];
$email=$_POST['email'];
$country=$_POST['country'];
Here you insert the above data without handling it properly, which makes you vulnerable to sql injection. Use prepared statements to safely use data in queries. More on that later
wortmann;11034059 wrote:
$sql="INSERT INTO $tbl_name(confirm_code, name, email, password, country)VALUES('$confirm_code', '$name', '$email', '$password', '$country')";
The mysql extension (all mysql_* functions) has been deprecated and will be removed. Do not use it.
wortmann;11034059 wrote:
$result=mysql_query($sql);
The remaining choices for PHP are ext/mysqli and PDO. In my opinion it's an easy choice because PDO offers support for named placeholders which mysqli does not. Thus, PDO allows you to do it this way
# Placeholders must start with : in the query
$sql="INSERT INTO $tbl_name(confirm_code, name, email, password, country)
VALUES(:confirm_code, :name, :email, :password, :country)";
# Assuming you have created an instance of pdo with $pdo = new PDO(...)
$stmt = $pdo->prepare($sql);
# The array keys may be written with or without leading : and correspond to the above :placeholders
$result = $stmt->execute(array(
'confirm_code' => $confirm_code,
'name' => $name,
'email' => $email,
'password' => $password,
'country' => $country
));
Using mysqli which lacks support for named placeholders, you'd have to
$sql="INSERT INTO $tbl_name(confirm_code, name, email, password, country)
VALUES(?, ?, ?, ?, ?)";
$stmt = $mysqli->prepare($sql);
# The first parameter should contain one character each corresponding to the data type inserted data (i = integer, s = string…)
$stmt->bind_param('sssss', $confirm_code, $name, $email, $password, $country);
$result = $stmt->execute();
As the number of parameters grow, the lack of named parameters makes it error prone and hard to debug.
On a side note, why do you insert the table name using a variable ($tbl_name)? I would at least guess that you always insert into the same table. If that is correct, put the table name directly in the string instead.
This is a possible source of problems
wortmann;11034059 wrote:
$header="from: SEAMM "; // From
Most MTAs will refuse to send emails lacking a valid email address. Some MTAs performs additional checks, such as making sure the email address belongs to the same domain and that it exists. "SEAMM" is not a valid email address. You can set an additional header "reply-to: ..." if you do not wish replies to go to the sender. Also, the line does not end with CRLF. Not sure if the mail functions handles the last (or only) header line lacking CRLF.
