that protect() function seems dead-on. Should be pretty injection-proof.
but it wasn't doing anything as it stood (protect($variable) instead of $variable = protect($variable). Another thing I noticed was that this function didn't 'return' anything), also the $password was spelt wrong in one of the protect()'s, and $action = $_GET['act']; should be $action = $_REQUEST['act']; Final thing I noticed was the SELECT = FROM - pretty sure = is not a wildcard, so changed it to *.
<?php
$con = mysql_connect("localhost","root","secret");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
function protect($value){
$value = mysql_real_escape_string(value);
$value = stripslashes($value);
$value = strip_tags($value);
return $value;
}
$action = $_REQUEST['act'];
protect($action);
if(!$action){
echo "<table border=0 cellspacing=3 cellpadding=3>\n
<form name=register method=post action=\"register.php?act=register\">\n
<tr><td>Username:</td><td><input type=text name=username maxlength=32>\n</td><tr>\n
<tr><td>Password:</td><td><input type=password name=password maxlength=64>\n</td></tr>\n
<tr><td>Confirm:</td><td><input type=password name=passconf maxlength=64>\n</td></tr>\n
<tr><td>Email:</td><td><input type=text name=email>\n</td></tr>\n
<tr><td>Confirm:</td><td><input type=text name=econf>\n</td></tr>\n
<tr><td>Gender</td><td><select name=gender>
<option value=gender>Male</option>\n
<option value=gender>Female</option>\n
<tr><td>Your Name</td><td><input type=text name=name maxlength=32>\n
<tr><td colspan=2 align=right><input type=submit value=\"Register\">\n";
}else{
echo 'Action = '.$action.'.<br />';
}
if($action=="register"){
$username = $_POST['username'];
$password = $_POST['password'];
$passconf = $_POST['passconf'];
$email = $_POST['email'];
$day = $_POST['gender'];
$name = $_POST['name'];
$username = protect($username);
$password = protect($password); // was spelt passwrod
$passconf = protect($passconf);
$email = protect($email);
$gender = protect($gender);
$name = protect($name);
if (isset($username) && isset($password) && isset($passconf) && isset($email) && isset($gender) && isset($name)){
if(strlen($username) < 3 || strlen($username) > 32){
echo "Username is either too short or too long\n";
}else {
if(strlen($password) < 3 || strlen($password) > 64){
echo "Password is either too short ot too long\n";
}else {
if(strlen($email) < 3 || strlen($email) > 64){
echo "Email is either too short ot too long\n";
}else {
if(strlen($name) < 2 || strlen($name) > 64){
echo "Your name is either too short or too long\n";
}else {
if($password != $passconf){
echo "Your password do not match\n";
}else {
if($email != $echoconf){
echo "Your emails do not match\n";
}else {
$checkemail = "/*[a-z0-9]+([_\\.-][a-z0-9]+)*@([a-z0-9]+([\.-][a-z0-9]-)+\\.(a-z)(2;)$/";
if(!preg_match($checkemail,$email)){
echo "The email you entered is incorrect";
}else {
$sql = "SELECT * FROM 'users' WHERE 'username' ='$username'";
$res = mysql_query($sql) or die(mysql_error());
if(mysql_num_rows($res) > 0){
echo "This username already exists";
}else {
$sql = "SELECT * FROM 'users' WHERE 'email' ='$email'";
$res = mysql_query($sql) or die(mysql_error());
if(mysql_num_rows($res) > 0){
echo "The email you supplied is already in use";
}else {
$sql = "SELECT * FROM 'users' WHERE 'ip' ='$_SERVER[REMOTE_ADDR]'";
$res = mysql_query($sql) or die(mysql_error());
if(mysql_num_rows($res) > 0){
echo "The IP is already in use";
}else {
$password = mds($password);
$date = date('f j, Y @ g:i:s a');
$sql = "INSTER INTO 'users' ('username','password','email','ip','name,'gender','date') VALUES('$username','$password,'$email','$_SERVER[REMOTE_ADDR]',' $gender,' $date);";
$res = mysql_query($sql) or die(mysql_error());
echo "Thank you for registering, you may now log in\n";
}
}
}
}
}
}
}
}
}
}
}
}else{
echo 'Action wasnt register';
}
?>
So basically this form will allow a user to register, validate the content, then insert the users data into the database with a "Thankyou for registering..." message
|