PHP registration form in mysql

Question

I am having problem in when I building the registration form with php and mysq. I have two files, contactus.php and home.php. The code for contactus.php is below:

    <?php
     session_start();
     $db = mysqli_connect("localhost", "wadca2user", "password123", "p1514432db");     
     if(isset($_POST['register_btn'])){
         session_start();         
         $username  = mysql_real_escape_string($_POST['username']);
         $email     = mysql_real_escape_string($_POST['email']);
         $password  = mysql_real_escape_string($_POST['password']);
         $password2 = mysql_real_escape_string($_POST['password2']);

         if($password == $password2){
             $password = md5($password); // stored before
             $sql      = "INSERT INTO users(username,email,password) Values('$username','$email','$password')";
             mysqli_query($db, $sql);
             $_SESSION['message'] = "Your are now logged in";   
             $_SESSION['username'] = $username;
             header("location: home.php");
         }else{
             $_SESSION['message'] = "The two passwords do not match";
         }
     }
?>
<!DOCTYPE html>
<html>
    <head>
        <link href="css/maincss.css" rel="stylesheet" type="text/css"/>
    </head>
    <body>
        <div class="header">
            <h1>Register</h1>
        </div>

        <form method="post" action="contactus.php">
            <table>
                <tr>
                    <td>Username:</td>
                    <td><input type="text" name="username" class="textInput"></td>
                </tr>
                <tr>
                    <td>Email:</td>
                    <td><input type="email" name="email" class="textInput"></td>
                </tr>
                <tr>
                    <td>Password:</td>
                    <td><input type="password" name="password" class="textInput"></td>
                </tr>
                <tr>
                    <td>Password again:</td>
                    <td><input type="password" name="password2" class="textInput"></td>
                </tr>
                <tr>
                    <td></td>
                    <td><input type="submit" name="register_btn" value="Register"></td>
                </tr>
            </table>
        </form>
    </body>
</html>

The code for home.php is below:

    <?php
     session_start();
?>
<!DOCTYPE html>
<html>
    <head>
        <link href="css/maincss.css" rel="stylesheet" type="text/css"/>
    </head>
    <body>
        <div class="header">
            <h1>Register</h1>
        </div>
        <h1>Home</h1>
        <div>
            <h3>Welcome<?php echo $_SESSION['username']; ?></h3>
        </div>
    </body>
</html>

After I click on submit, it is supposed to go to home.php. However, it does not succeed. I am not sure where is my problem.

Here is mysql 'users' table

Answer 1

Use PDO, this (below) should do the job, it's secure against sql injection (check prepared request for more). You must not use MD5, it's deprecated, try sha1() or sha256(). Edit : you also have password_hash() which is quite nice.

<?php
session_start();
$servername = "localhost";
$username = "wadca2user";
$password = "password123";
$conn = null;
try {
    $conn = new PDO("mysql:host=$servername;dbname=p1514432db", $username, $password);
    // set the PDO error mode to exception
    $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
    echo "Connected successfully";
    }
catch(PDOException $e)
    {
    echo "Connection failed: " . $e->getMessage();
    }
if(isset($_POST['register_btn']) && !is_null($conn)){
     $username  = $_POST['username'];
     $email     = $_POST['email'];
     $password  = $_POST['password'];
     $password2 = $_POST['password2'];

     if($password === $password2){
         $password = md5($password); // stored before
         $request = $conn->prepare("INSERT INTO users (username,email,password) VALUES (:username, :email, :password)");
         $request->bindParam(':username', $username);
         $request->bindParam(':email', $email);
         $request->bindParam(':password', $password);
         $request->execute();
         $_SESSION['message'] = "Your are now logged in";   
         $_SESSION['username'] = $username;
         header("location: home.php");
     }else{
         $_SESSION['message'] = "The two passwords do not match";
     }
 }
?>

PHP registration form in mysql

Question

1 answers

solution1
2 ACCPTED 2017-01-22 05:27:38

PHP registration form in mysql

Question

1 answers

solution1 2 ACCPTED 2017-01-22 05:27:38

solution1
2 ACCPTED 2017-01-22 05:27:38