-1

So im trying to build a login system for a website im developing and i am very new to php so i've jumped in the deep end a bit. My aim is to create a Register Form where if the passwords dont match it doesnt add the data and displays an error and if the username is taken. I have found the codes for both of these but im unsure how to implement them together.

<?php
$dbhost = "localhost";
$dbuser = "root";
$dbpass = "";
$dbname = "immo";

//Connection to the DB
$con = mysqli_connect($dbhost,$dbuser,$dbpass,$dbname) or die ($dberror1);

    session_start();
    if (isSet($_POST['Register']) && isSet($_POST['Username']) && isSet($_POST['Password']) && $_POST['Username'] != '' && $_POST['Password'] != '') {
        $Password = $_POST['Password'];
        $passMD5 = md5($Password);
        $Username = $_POST['Username'];
        $q = mysqli_query($con, "SELECT * FROM `users` WHERE `Username`='$Username'");
        if (mysqli_num_rows($q) > 0) {
            echo 'That username is already taken.';
        }
        if ($_POST['Password']!= $_POST['ConfirmPassword']){
            echo("Oops! Password did not match! Try again. ");
        }
        else{
            $qq = mysqli_query($con, "INSERT INTO `users` VALUES ('', '$Username', '$passMD5')");
            if ($qq) {
                echo 'Registered successfully!';
            }else
                echo 'Failed to register.';
        }
    }
?>


<form method="post" class="registration_form">
  <fieldset>
<legend>Registration Form </legend>

<table>
 <tbody>
<tr>
  <td class="label"><label for="Username">Username :</label></td>
  <td class="input"><input type="text" id="Username" name="Username" required/></td>
  <td class="error"></td>
</tr>
<tr>
  <td class="label"><label for="Fname">First Name :</label></td>
  <td class="input"><input type="text" id="Firstname" name="Firstname" required/></td>
  <td class="error"></td>
</tr>
<tr>
  <td class="label"> <label for="Lname">Last Name :</label></td>
  <td class="input"><input type="text" id="Lastname" name="Lastname" required/></td>
  <td class="error"></td>
</tr>
<tr>
  <td class="label"><label for="e-mail">E-mail :</label></td>
  <td class="input"><input type="email" id="Email" name="Email" required/></td>
  <td class="error"></td>
</tr>
<tr>
  <td class="label"><label for="Password">Password:</label></td>
  <td class="input"><input type="password" id="Password" name="Password" required/></td>
  <td class="error"></td>
</tr>
<tr>
  <td class="label"><label for="ConfirmPassword">Confirm Password:</label></td>
 <td class="input"><input type="password" id="ConfirmPassword" name="ConfirmPassword" required/></td>
  <td class="error"></td>
</tr>
<tr>
  <td><input type="hidden" name="formsubmitted" value="TRUE" /></td>
  <td><input type="submit"  id="Register" value="Register" name="Register" /></td>
  <td class="error"></td>
</tr>
 </tbody>
</table>
  </fieldset>
</form>
nathzOO
  • 1
  • 1
  • Sidenote: You can reduce your entire `if (isSet($_POST['Register'])....` to simply `if (!empty($_POST['Register'])....` and for the rest of them and without the need of `!= ''` or simply a ternary operator. – Funk Forty Niner Sep 04 '15 at 16:21
  • You really shouldn't use MD5 password hashes and you really should use PHP's [built-in functions](http://jayblanchard.net/proper_password_hashing_with_PHP.html) to handle password security. If you're using a PHP version less than 5.5 you can use the `password_hash()` [compatibility pack](https://github.com/ircmaxell/password_compat). – Jay Blanchard Sep 04 '15 at 16:24
  • [Your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) – Jay Blanchard Sep 04 '15 at 16:24
  • Not to overwhelm you or anything, but this code isn't safe. Do not use it. Have a look here http://bobby-tables.com/ (and http://bobby-tables.com/php.html) for info on how to safely use mysqli. Also, see http://php.net/password_hash and http://php.net/password_verify for info on passwords. `md5()` is not a good idea. – gen_Eric Sep 04 '15 at 16:24
  • *"and displays an error and if the username is taken"* - being? Plus, there's no HTML form that goes with this, you're not checking for errors anywhere, *far as I can see.* – Funk Forty Niner Sep 04 '15 at 16:24
  • Also, what exactly are you asking? Is there something wrong with this code? – gen_Eric Sep 04 '15 at 16:25
  • @RocketHazmat yeah, probably the parts they're not showing. – Funk Forty Niner Sep 04 '15 at 16:36
  • Ok, I've said it many times before and I'll mention it again. Add error reporting to the top of your file(s) right after your opening PHP tag for example ` – Funk Forty Niner Sep 04 '15 at 16:39
  • This does nothing `or die ($dberror1);` and `$dberror1` is undefined. What you need to do is `or die(mysqli_error($con))` and get the real error, should there be any. I made a mistake earlier `die(mysql_error()) to mysql_query()` should have been `die(mysqli_error($con)) to mysqli_query()` – Funk Forty Niner Sep 04 '15 at 16:48

1 Answers1

1

Not pretty, but:

<?php
    session_start();
    if (isSet($_POST['Register']) && isSet($_POST['Username']) && isSet($_POST['Password']) && $_POST['Username'] != '' && $_POST['Password'] != '') {
        $Password = $_POST['Password'];
        $passMD5 = md5($Password);
        $Username = $_POST['Username'];
        $q = mysqli_query($con, "SELECT * FROM `users` WHERE `Username`='$Username'");
        if (mysqli_num_rows($q) == 0) {         
            if ($_POST['Password'] == $_POST['ConfirmPassword']){
                $qq = mysqli_query($con, "INSERT INTO `users` VALUES ('', '$Username', '$passMD5')");
                if ($qq) {
                    echo 'Registered successfully!';
                } else {
                    echo 'Failed to register.';
                }
            } else {
                echo "Oops! Password did not match! Try again.";
            }
        } else {
            echo 'That username is already taken.';
        }
    }
?>
Tyler Collins
  • 127
  • 10