My code technically works, as it registers the user, but it won't keep the user logged in. (yes, once a registration is successful, they should be logged into their new account). It should go right to the index page on success and have the user logged in.
On failure it should reload the page with an error message with in the <p id="error"></p> tags. It doesn't but thats another issue.
so registration.php:
<?php
require_once('checklogin.php');
if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "form"))
{
$con = mysql_connect('localhost','jddancks','csc255');
mysql_select_db('dancks_db',$con);
$match = array();
$query = sprintf("SELECT * FROM UserTable WHERE nick='%s' OR email='%s'",
mysql_real_escape_string($_POST['nick']),
mysql_real_escape_string($_POST['e-mail']));
$test = mysql_query($query,$con) or die(mysql_error()." line 10");
if(mysql_num_rows($test)>0)
{
$_SESSION['error']=" Someone is already registered with that username/email combination";
}
else
{
//test username:
preg_match("/[A-Za-z]+[A-Za-z0-9]{6,12}/",$_POST['nick'],$match);
if(implode($match)!=$_POST['nick'])
{
$_SESSION['error']="Nick did not meet specifications.";
}
//test email:
preg_match("/[A-Za-z0-9]{4,12}+@[A-Za-z0-9]{3,12}+\.[A-Za-z0-9.]{2,5}/",$_POST['e-mail'],$match);
if(implode($match)!=$_POST['e-mail'])
{
if(isset($_SESSION['error']))
{
$_SESSION['error']=$_SESSION['error']." Email did not meet specifications.";
}
else
{
$_SESSION['error']=" Email did not meet specifications.";
}
}
//test pass:
preg_match("/[A-Za-z0-9]{8,20}/",$_POST['pass'],$match);
if(implode($match)!=$_POST['pass'])
{
if(isset($_SESSION['error']))
{
$_SESSION['error']=$_SESSION['error']." Password did not meet specifications.";
}
else
{
$_SESSION['error']=" Password did not meet specifications.";
}
}
if(!isset($_SESSION['error']))
{
unset($_SESSION['error']);
$query = sprintf("INSERT INTO UserTable(nick,email,pass) VALUES ('%s','%s',SHA1('%s'))",
mysql_real_escape_string($_POST['nick']),
mysql_real_escape_string($_POST['e-mail']),
mysql_real_escape_string($_POST['pass']));
$reg = mysql_query($query,$con) or die(mysql_error()." line 57");
//sleep(1);//I didn't think it would be smart to do back to back query on same data.
$get_data = mysql_query(sprintf("SELECT userID FROM UserTable WHERE nick='%s' AND pass=SHA1('%s')",
mysql_real_escape_string($_POST['nick']),
mysql_real_escape_string($_POST['pass'])
)) or die(mysql_error()+"line 62");
if(mysql_num_rows($get_data)!=1)
{
die("select statement for new user did not match anything in table\n");
}
$reg2 = mysql_fetch_assoc($get_data);
$_SESSION['name']="SHOP";
$_SESSION['user']=$_POST['nick'];
$_SESSION['ID'] = $reg2['userID'];
$_SESSION['email']=$_POST['e-mail'];
$_SESSION['date']=date('m/d/y');
$_SESSION['time']=time() + (60*60*2); //stay logged in for 2 hours
mysql_free_result($get_data);
mysql_close($con);
header('Location:http://cs4.sunyocc.edu/~j.d.dancks/onestopshop/index.php');
}
}//end else
mysql_free_result($test);
mysql_close($con);
}//end if MM_Insert
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>Register to list items and bid at the Onestopshop</title>
<script src="SpryAssets/SpryValidationPassword.js" type="text/javascript"></script>
<script src="SpryAssets/SpryValidationConfirm.js" type="text/javascript"></script>
<script type="text/javascript">
if(<?php echo isset($_SESSION['error']);?>)
{
document.getElementById("error").style.visiblity="visible";
document.getElementById("error").style.background-color=#FF;
}
</script>
<style type="text/css">
#error
{
visiblity="hidden";
}
</style>
<link href="SpryAssets/SpryValidationPassword.css" rel="stylesheet" type="text/css" />
<link href="SpryAssets/SpryValidationConfirm.css" rel="stylesheet" type="text/css" />
</head>
<body>
<p id="error" hidden="true"><?php echo (isset($_SESSION['error'])?$_SESSION['error']:""); ?></p>
<form action="register2.php" name="form" method="POST">
<p>non-alphanumeric characters are not allowed. First character in username and email has to be a letter.</p>
<p>User name: <input type="text" name="nick" id="nick" value="<?php echo (isset($_POST['nick'])?$_POST['nick']:"");?>"/></p>
<p>password: <span id="sprypassword1">
<input type="password" name="pass" id="pass" /><span>Password be be between 8-20 characters, 1 upper case, 2 numbers and minimum 4 letters total.</span>
<span class="passwordRequiredMsg">A value is required.</span><span class="passwordMinCharsMsg">Minimum number of characters not met.</span><span class="passwordMaxCharsMsg">Exceeded maximum number of characters.</span><span class="passwordInvalidStrengthMsg">The password doesn't meet the specified strength.</span></span></p>
<span id="spryconfirm1">
<label for="pass2">re-type password:</label>
<input type="password" name="pass2" id="pass2" />
<span class="confirmRequiredMsg">A value is required.</span><span class="confirmInvalidMsg">The values don't match.</span></span>
<p>email: <input type="email" name="e-mail" id="e-mail" value="<?php echo (isset($_POST['e-mail'])?$_POST['e-mail']:"");?>"/>Note: Hostname (name following'@') needs to be at least 3 characters long. What proceeds after the dot should be between 2 and 5 characters long</p>
<input type="hidden" name="MM_insert" value="form" />
<input type="submit" />
</form>
<script type="text/javascript">
var sprypassword1 = new Spry.Widget.ValidationPassword("sprypassword1", {minChars:8, maxChars:20, minUpperAlphaChars:1, minNumbers:2, minAlphaChars:4});
var spryconfirm1 = new Spry.Widget.ValidationConfirm("spryconfirm1", "pass", {validateOn:["change"]});
</script>
</body>
</html>
relevant: checklogin.php:
<?php
session_start();
$good = true;
function redir()
{
//die("redir is called");
if(isset($_SERVER['HTTP_REFERER']))
{
header('Location:'.$_SERVER['HTTP_REFERER']);
}
else
{
header('Location:http://cs4.sunyocc.edu/~j.d.dancks/onestopshop/index.php');
}
}
function logout()
{
$_SESSION = array();
session_destroy();
//header('Location:http://cs4.sunyocc.edu/~j.d.dancks/index.php');
}
if(isset($_SESSION['attempts']))
{
if($_SESSION['attempts']>=5)
{
$good=false;
}
}
if($good)
{
if(!isset($_SESSION['time']) || !isset($_SESSION['user']))
{
logout();
}
else if($_SESSION['time'] < time())
{
logout();
}
}
else
{
logout();
redir();
}
function cleanup($junk)
{
/*$ref = array();
$ref = $_SESSION;
$_SESSION = array();
foreach($var as $ref)
{
if(!isset($_POST[array_keys($ref,$var)]))
{
$_SESSION[$var] = $ref[$var];
}
}*/
//die("cleanup called\n");
foreach($junk as $var)
{
$k = array_keys($junk,$var);
if(isset($junk[$k[0]]))
{
unset($_SESSION[$k[0]]);
}
}
}
?>