PHP Register Script

DealthRune 1 315 Views

A simple register script

<?php
$con = mysql_connect('localhost', 'root', '') OR die("Error: ".mysql_error());
mysql_select_db('db_name', $con) OR die("Error: ".mysql_error());

function protect($string){
    $string = mysql_real_escape_string($string);
    $string = strip_tags($string);
    $string = addslashes($string);

    return $string;
}
if(!$_POST['submit']){
    echo "<table border=\"0\" cellspacing=\"3\" cellpadding=\"3\" align=\"center\">\n";
    echo "<form method=\"post\" action=\"".$self."\">\n";
    echo "<tr><td colspan=\"2\" align=\"center\" bgcolor=\"#333333\"><font color=\"#ffffff\">Registration Form</font></td></tr>\n";
    echo "<tr><td>Username</td><td><input type=\"text\" name=\"username\"></td></tr>\n";
    echo "<tr><td>Password</td><td><input type=\"password\" name=\"password\"></td></tr>\n";
    echo "<tr><td>Confirm</td><td><input type=\"password\" name=\"passconf\"></td></tr>\n";
    echo "<tr><td>E-Mail</td><td><input type=\"text\" name=\"email\"></td></tr>\n";
    echo "<tr><td align=\"left\"><input type=\"submit\" name=\"submit\" value=\"Register\"></form></td><form action='login.php' method='POST'><td align=\"right\"><input type=\"submit\" value=\"Login\"></td></tr>\n";
    echo "</form></table>\n";
}else {
    $username = protect($_POST['username']);
    $password = protect($_POST['password']);
    $confirm = protect($_POST['passconf']);
    $email = protect($_POST['email']);

    $errors = array();

        if(!$username){
            $errors[] = "Username is not defined!";
        }

        if(!$password){
            $errors[] = "Password is not defined!";
        }

        if($password){
            if(!$confirm){
                $errors[] = "Confirmation password is not defined!";
            }
        }

        if(!$email){
            $errors[] = "E-mail is not defined!";
        }



        if($username){
            if(!ctype_alnum($username)){
                $errors[] = "Username can only contain numbers and letters!";
            }

            $range = range(1,32);
            if(!in_array(strlen($username),$range)){
                $errors[] = "Username must be between 1 and 32 characters!";
            }
        }

        if($password && $confirm){
            if($password != $confirm){
                $errors[] = "Passwords do not match!";
            }
        }

        if($email){
            $checkemail = "/^[a-z0-9]+([_\\.-][a-z0-9]+)*@([a-z0-9]+([\.-][a-z0-9]+)*)+\\.[a-z]{2,}$/i";
            if(!preg_match($checkemail, $email)){
                $errors[] = "E-mail is not valid, must be name@server.tld!";
            }
        }


        if($username){
            $sql = "SELECT * FROM `users` WHERE `username`='".$username."'";
            $res = mysql_query($sql) or die(mysql_error());

                if(mysql_num_rows($res) > 0){
                    $errors[] = "The username you supplied is already in use!";
                }
        }

        if($email){
            $sql2 = "SELECT * FROM `users` WHERE `email`='".$email."'";
            $res2 = mysql_query($sql2) or die(mysql_error());

                if(mysql_num_rows($res2) > 0){
                    $errors[] = "The e-mail address you supplied is already in use of another user!";
                }

        }

        if(count($errors) > 0){
            foreach($errors AS $error){
                echo $error . "<br>\n";
            }
        }else {
            $sql4 = "INSERT INTO `users`
                    (`username`,`password`,`email`)
                    VALUES ('".$username."','".$password."','".$email."')";
            $res4 = mysql_query($sql4) or die(mysql_error());
            echo "<font align=\"center\"><br><br>You have successfully registered with the username <b>".$username."</b> and the password <b>".$password."</b>!</font>";
        }
}

Dani AI

Generated

A short expert addendum to the example by and the follow-ups:

The snippet is an old-style registration example with several serious issues: it uses the removed mysql_* extension, stores and even prints plaintext passwords, relies on manual escaping (including addslashes) instead of parameterized queries, and echoes unescaped user data back to the page. Migrate to PDO or MySQLi prepared statements, use password_hash()/password_verify() for passwords, validate emails with filter_var(), and escape any output with htmlspecialchars() before printing. See the PHP docs for the mysql deprecation, prepared statements and password hashing for details: MySQL extension deprecation — prepared statements guide — password_hash. (php.net)

About ’s SQL error: the MySQL server was seeing identifiers quoted as strings. Table/column names must not be single-quoted — use unquoted names or backticks; string values must use quotes. Example:

-- wrong:
SELECT * FROM 'detail' WHERE 'username'='110755';

-- correct:
SELECT * FROM `detail` WHERE `username` = '110755';

See MySQL identifier quoting rules. (dev.mysql.com)

Practical, minimal upgrade (conceptual): validate input, hash the password, then insert with a prepared statement — do not echo the password back. Example pattern:

$email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);
$hash = password_hash($password, PASSWORD_DEFAULT);
$stmt = $pdo->prepare("INSERT INTO users (username, password, email) VALUES (?, ?, ?)");
$stmt->execute([$username, $hash, $email]);

Use filter_var() for email checks and follow OWASP guidance on password storage (use modern algorithms and parameters). (php.net)

To and : if you copied code (as noted), update it before use. If you must avoid SQL for learning or tiny single-user projects, consider SQLite (embedded DB) or a properly locked JSON/CSV file using flock() for writes — but be aware of concurrency, atomicity, and security implications; for production, use a real DB and modern practices.

Member Avatar for una88
una88 0 Newbie Poster

i can't run..do to this error..
MySQL server version

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''detail' WHERE 'username'='110755'' at line 1

Member Avatar for Dartz654
Dartz654 0 Newbie Poster

This looks an awfully lot like the register script at . As do all your scripts.

Member Avatar for kamotekid08
kamotekid08 0 Newbie Poster

hi there..i have to create a php registration without using sql instead .text/notepad will restore the data..pls help me with this..thanx

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview