**my functions.php file**
<?php
function confirmquery( $result ){
global $db;
if(!$result){
die("OUERY FAILED .".mysqli_error($db));
}
}
function redirect($location){
return header("Location:". $location);
}
function is_admin($username = ''){
global $db;
$sql = "SELECT user_role FROM users WHERE username = '$username'";
$result = mysqli_query($db, $sql);
confirmquery( $result );
$row = mysqli_fetch_array($result);
if ($row['user_role'] == 'admin') {
return true;
}else {
return false;
}
}
function username_exists($username = ''){
global $db;
$sql = "SELECT 'username' FROM users WHERE 'username' = '$username'";
$result = mysqli_query($db, $sql);
confirmquery( $result );
if (mysqli_num_rows($result) > 0) {
return true;
}else {
return false;
}
}
function email_exists($user_email = ''){
global $db;
$sql = "SELECT 'user_email' FROM users WHERE 'user_email' = '$user_email'";
$result = mysqli_query($db, $sql);
confirmquery( $result );
if (mysqli_num_rows($result) > 0) {
return true;
}else {
return false;
}
}
function recordCount($table){
global $db;
$sql =" SELECT * FROM ".$table;
$result = mysqli_query($db, $sql);
return mysqli_num_rows($result);
}
function register_user($username,$user_email,$user_password){
global $db;
$username =mysqli_real_escape_string($db,$username);
$user_email =mysqli_real_escape_string($db,$user_email);
$user_password=mysqli_real_escape_string($db,$user_password);
$user_password = password_hash($user_password, PASSWORD_BCRYPT, array('COST' => 12 ));
$sql="INSERT INTO `users`
SET
`username` ='{$username}',
`user_email` ='{$user_email}',
`user_password` ='{$user_password}',
`user_role` ='user'";
$result = mysqli_query($db, $sql);
confirmquery( $result );
}
function login_user($user_email, $user_password){
global $db;
$user_email =trim($user_email);
$user_password =trim($user_password);
$user_email = mysqli_real_escape_string($db,$user_email);
$user_password = mysqli_real_escape_string($db,$user_password);
$sql = "SELECT * FROM `users` WHERE user_email='{$user_email}'";
$result = mysqli_query($db, $sql);
if(!$result){
die("OUERY FAILED .".mysqli_error($db));
}
while($row = mysqli_fetch_array($result)){
$db_user_id = $row['user_id'];
$db_username = $row['username'];
$db_user_email = $row['user_email'];
$db_user_password = $row['user_password'];
$db_user_firstname = $row['user_firstname'];
$db_user_lastname = $row['user_lastname'];
$db_user_role= $row['user_role'];
}
// $user_password = crypt($user_password,$db_user_password);
if (password_verify($user_password, $db_user_password)) {
$_SESSION['db_username'] = $db_username;
$_SESSION['db_user_firstname'] = $db_user_firstname;
$_SESSION['db_user_lastname'] = $db_user_lastname;
$_SESSION['db_user_role'] = $db_user_role;
redirect("/gms/index.php");
}
}
?>
**My registration.php file**
<?php include "includes/connect.php"; ?>
<?php include "includes/header.php"; ?>
<?php include "./admin/functions.php"; ?>
<?php
if ($_SERVER['REQUEST_METHOD'] == "POST") {
$username =trim($_POST['username']);
$user_email =trim($_POST['email']);
$user_password =trim($_POST['password']);
$error = [
'username' => '',
'email' => '',
'password' => ''
];
if(strlen($username) < 4){
$error['username'] = 'Username needs to be longer';
}
if($username == ''){
$error['username'] = 'Username cannot be empty';
}
if(username_exists($username)){
$error['username'] = 'Username already exists';
}
if($user_email == ''){
$error['email'] = 'Email cannot be empty';
}
if(email_exists($user_email)){
$error['email'] = 'Email already exists, <a href = "index.php">Please login</a>';
}
if($user_password == ''){
$error['password'] = 'Password cannot be empty';
}
foreach ($error as $key => $value) {
if(empty($value)){
unset($error[$key]);
}
}
if(empty($error)){
register_user($username, $user_email, $user_password);
login_user($user_email, $user_password );
}
}
?>
<!-- Navigation -->
<?php include "includes/navigation.php"; ?>
<!-- Page Content -->
<div class="container">
<section id="login">
<div class="container">
<div class="row">
<div class="col-xs-6 col-xs-offset-3">
<div class="form-wrap">
<h1>Register</h1>
<form role="form" action="registration.php" method="post" id="login-form" autocomplete="oFF">
<div class="form-group">
<label for="username" class="sr-only">username</label>
<input type="text" name="username" id="username" class="form-control" placeholder="Enter Desired Username"
autocomplete="on"
value = "<?php echo isset($username) ? $username : '' ?>" >
<p><?php echo isset($error['username']) ? $error['username'] : '' ?></p>
</div>
<div class="form-group">
<label for="email" class="sr-only">Email</label>
<input type="email" name="email" id="email" class="form-control" placeholder="somebody@example.com"
value = "<?php echo isset($user_email) ? $user_email : '' ?>">
<p><?php echo isset($error['email']) ? $error['email'] : '' ?></p>
</div>
<div class="form-group">
<label for="password" class="sr-only">Password</label>
<input type="password" name="password" id="key" class="form-control" placeholder="Password">
<p><?php echo isset($error['password']) ? $error['password'] : '' ?></p>
</div>
<input type="submit" name="register" id="btn-login" class="btn btn-custom btn-lg btn-block" value="Register">
</form>
</div>
</div> <!-- /.col-xs-12 -->
</div> <!-- /.row -->
</div> <!-- /.container -->
</section>
<hr>
<?php include "includes/footer.php";?>
Passy 0 Newbie Poster
rproffitt 2,662 "Nothing to see here." Moderator
The input doesn't appear safe. Is your site available so I can try
value'); DROP TABLE table;--
On the input fields or such to test if you can stand up to a good old fun like:
https://www.explainxkcd.com/wiki/index.php/Little_Bobby_Tables#Example_of_SQL_injection
Line 73 for example looks like open to injection. Maybe others.
Be a part of the DaniWeb community
We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.