我无法获取将信息放入mysql的php

Question

I have a form that talks to 'process_register.php' to register a user. That file talks to a class called 'user'.

<form method="post" action="process_register.php">
    User Name: <input type="text" name="userName" maxlength="32"><br>
    Password: <input type="password" name="userPassword" maxlength="32"><br>
    <input type="submit">
</form>

process_register.php

<?php
// process_register.php

include('userclass.php');

$newUser = new User;

// Call the registerUser() method, passing in the required variables
$newUser->registerUser($userName, $userPassword);

// If it was an error, the class will kill the script, if not, it will reach this point
$newUser->displayUserInfo();
?>

userclass.php

<?
// process_register.php
class User {
var $userID,
        $userName,
        $userPassword,
        $dbHost,
        $dbUser,
        $dbName,
        $dbPass,
        $dbUserTable;
function registerUser($userName, $userPassword) {
        // Connect to database
        $dbLink = mysql_connect($this->dbHost, $this->dbUser, $this->dbPass);
        if(!$dbLink) die("Could not connect to database. " . mysql_error());

        // Select database
        mysql_select_db($this->dbName);

        $query = "insert into $this->dbUserTable values (NULL, \"$userName\", \"$userPassword\")";
        $result = mysql_query($query);

        // Test to make sure query worked
        if(!$result) die("Query didn't work. " . mysql_error());

        // Get the user ID
        $this->userID = mysql_insert_id();

        // Close database connection
        mysql_close($dbLink);

        // Assign the values to the data members
        $this->userName = $userName;
        $this->userPassword = $userPassword;
    } // End registerUser()
function displayUserInfo() {
        echo '<b>User ID: </b>' . $this->userID . '<br>';
        echo '<b>User Name: </b>' . $this->userName . '<br>';
        echo '<b>User Password: </b>' . $this->userPassword . '<br>';
    } // End displayUserInfo()

The problem is when process_register.php calls 'displayUserInfo' it creates a slot in the DB for the new user but it is blank.

any help is much appreciated

Answer 1

You need to assign values ​​to variables from the array $ _POST in "process_register.php" file before line

$newUser->registerUser($userName, $userPassword);

. For example,

$userName = $_POST['userName'];
$userPassword = $_POST['userPassword'];

But do not forget to filter user input data.

Answer 2

Are you following an old tutorial?

On the line, $newUser->registerUser($userName, $userPassword); It assumes $userName, $userPassword are global variables. Older versions of PHP had regisrered globals on by default. In current versions of PHP you must do this:

$newUser->registerUser($_REQUEST['userName'], $_REQUEST['userPassword']);

Also, please make sure that you use mysql_real_escape_string() on all data added to the query - you are open to an SQL injection if you don't do this.

Answer 3

you may also want to change the insert statement to put in MD5 passwords instead of clear text.

$userPassword = md5($userPassword); before the insert

not "necessary", but a good security measure for future reference.