-
Notifications
You must be signed in to change notification settings - Fork 1
/
register.php
106 lines (90 loc) · 3.27 KB
/
register.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
<?php require("layout.php"); ?>
<?php render("header", ["title"=>"Register"]); ?>
<?php
// if someone is already logged in then redirect
if (!empty($_SESSION['id'])){
echo "<script>location.href='index.php';</script>";
}
// form is submitted
if ($_SERVER["REQUEST_METHOD"] == "POST")
{
// ensure user co-operated
if(!empty($_POST['username']) && !empty($_POST['password']) && !empty($_POST['re_password']))
{
/** entering the new user into database */
require("dbconfig.php");
// connecting to the database
try {
$conn = mysqli_connect($host, $username, $password, $dbname);
//echo "Connected to $dbname at $host successfully.";
} catch (PDOException $pe) {
die("Could not connect to the database:" . $pe->getMessage());
}
// for any creepy thing https://www.w3schools.com/php/php_form_validation.asp
function test_input($data) {
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
return $data;
}
$username = test_input($_POST["username"]);
// ensuring both password are same
if($_POST['password'] != $_POST['re_password']){
echo '<script language="javascript">window.alert("Password doesn\'t match")</script>';
}
// Querying the database
$password = crypt($_POST["password"],50);
// ensure its a unique username
$sql = 'SELECT uname FROM users';
if ($r=mysqli_query($conn, $sql)) {
} else {
echo "Error: " . $sql . "<br>" . mysqli_error($conn);
echo "<script>location.href='index.php';</script>";
}
while($n = mysqli_fetch_assoc($r)){
if($n['uname'] == $username){
echo '<script language="javascript">';
echo 'window.alert("Username already exists...try other names")';
echo '</script>';
}
}
// saving it to db "SQL INJECTION PRONE!"
$sql = 'INSERT INTO users (uname, hash) VALUES ("'.$username.'","' .$password.'")';
if (mysqli_query($conn, $sql)) {
$last_id = mysqli_insert_id($conn);
} else {
echo "Error: " . $sql . "<br>" . mysqli_error($conn);
}
// all goes well then
mysqli_close($conn);
$_SESSION['id'] = $last_id;
$_SESSION['name'] = $username;
echo "<script>location.href='index.php';</script>";
}
// if something goes invalid
else
{
echo '<script language="javascript">';
echo 'window.alert("Invalid Username Or Password")';
echo '</script>';
}
}
?>
<!-- html for the login form -->
<form action="<?= htmlspecialchars($_SERVER["PHP_SELF"]); ?>" method="post">
<fieldset>
<div class="form-group">
<input autocomplete="off" autofocus class="form-control" name="username" placeholder="Username" type="text"/>
</div>
<div class="form-group">
<input class="form-control" name="password" placeholder="Password" type="password"/>
</div>
<div class="form-group">
<input class="form-control" name="re_password" placeholder="Confirm Password" type="password"/>
</div>
<div class="form-group">
<button class="btn btn-default" name="login" type="submit">Register</button>
</div>
</fieldset>
</form>
<?php render("footer"); ?>