<?php
require("config1.php");
/*
Changes I made:
- Variable Changes:
- Instead of $string = "$_POST[username] is my name." I did:
- $string = $_POST['username']" is my name";
- Error reporting on mysql DIE function now more clear (gives # so you can easily search for it)
- improved user-defined functions
- added mysql_real_escape_string when checking against DB. <-- Security
*/
//
// I Changed this because you do NOT need to loop through each character.
// It will check the overall string and if any of the characters are not alphanumeric,
// then it will return false
//
function is_alphachar($text)
{
if (!ereg("[A-Za-z0-9]", $text))
{
return FALSE;
}
else
{
return TRUE;
}
}
function checkEmail($email)
{
if (!preg_match("/^( [a-zA-Z0-9] )+( [a-zA-Z0-9\._-] )*@( [a-zA-Z0-9_-] )+( [a-zA-Z0-9\._-] +)+$/" , $email))
{
return TRUE;
}
else
{
return TRUE;
}
}
$form .= "Register a new username. Be sure to enter a <b>genuine</b> email as it will be used to recover your account.<br>";
$form .= "<form action=\"test_file.php\" method=\"POST\">";
$form .= "Username: <br><input type=\"text\" name=\"username\" value=\"".$_POST['username']."\"><br>";
$form .= "Your email: <br><input type=\"text\" name=\"email\" value=\"".$_POST['email']."\"><br>";
$form .= "Password: <br><input type=\"password\" name=\"password\" value=\"".$_POST['password']."\"><br>";
$form .= "First Name: <br><input type=\"text\" name=\"firstname\" value=\"".$_POST['firstname']."\"><br>";
$form .= "Last Name: <br><input type=\"text\" name=\"lastname\" value=\"".$_POST['lastname']."\"><br>";
$form .= "Address: <br><input type=\"text\" name=\"address\" value=\"".$_POST['address']."\"><br>";
$form .= "City: <br><input type=\"text\" name=\"city\" value=\"".$_POST['city']."\"><br>";
$form .= "State: <br><input type=\"text\" name=\"state\" value=\"".$_POST['state']."\"><br>";
$form .= "Zipcode: <br><input type=\"text\" name=\"zip\" value=\"".$_POST['zip']."\"><br>";
$form .= "<input type=\"submit\" value=\"Create!\">";
$form .= "</form>";
if(empty($_POST['username']))
{
echo $form;
}
elseif(strlen($_POST['password']) < 6)
{
echo $form;
echo "<br> Error password must be 6 characters or more";
}
else
{
$connection = mysql_connect($hostname, $user, $pass) or die("Error 1: ".mysql_error());
$db = mysql_select_db($database, $connection) or die("Error 2: ".mysql_error());
//
// Added mysql_real_escape_string() function for improved security
//
$sql = "SELECT username FROM ".$userstable." WHERE username = '".mysql_real_escape_string($_POST['username'])."'";
$sql2 = "SELECT email FROM ".$userstable." WHERE email = '".mysql_real_escape_string($_POST['email'])."'";
$result = mysql_query($sql) or die ("Error 3: ".mysql_error());
$result2 = mysql_query($sql2) or die ("Error 4: ".mysql_error());
$num = mysql_num_rows($result);
$num2 = mysql_num_rows($result2);
if (is_alphachar($_POST['username']) == FALSE)
{
echo $form;
echo "Invalid Username. Only numbers/letters are allowed.<br>";
DIE;
}
if ($num == 1)
{
echo "Error, username already exists!";
}
elseif ($num2 == 1)
{
echo "Error, that email address has already been registered. Please select a different one.";
}
else
{
//
// Added Vcode since it isn't in this file and it DOESN'T come from via $_POST method
//
$vcode = "random_verification_code";
$ip = $_SERVER['REMOTE_ADDR'];
$query = "INSERT INTO ".$userstable." (username, password, email, vcode, address, city, state, zip, ip, firstname, lastname)
VALUES ('".$_POST['username']."','".$_POST['password']."','".$_POST['email']."','".$vcode."','".$_POST['address']."','".$_POST['city']."','".$_POST['state']."','".$_POST['zip']."','".$ip."','".$_POST['firstname']."','".$_POST['lastname']."')";
$resultB = mysql_query($query,$connection) or die("Error 4: ".mysql_error());
$cookie_name = "auth";
$cookie_value = "fook!".$_POST['username'];
$cookie_expire = "0";
$cookie_domain = $domain;
setcookie($cookie_name, $cookie_value, $cookie_expire, "/", $cookie_domain, 0);
echo "Congratulations ".$tmpname.". Your account has been created and added to database";
echo "<br>You are now logged in.";
echo "<br>Click <a href=\"index.php\">here</a> to goto members area";
}
}
?>
