i tried making a user login/registration script and posted it another forum and i got flamed by a mod saying it was the worst he had ever seen. now i admitted up front i was a noob but i don't think it's that bad. any glaring holes (apart from it has no anti-spam protection)
sorry no comments but it's fairly basic i think.
PHP:
<?php
session_start();
include 'db_connect.php';
$here = 'http://'.$_SERVER["SERVER_NAME"].$_SERVER["SCRIPT_NAME"];
if($_GET['do'] == 'logout') {
unset($_SESSION['isloggedin']);
unset($_SESSION['username']);
header("Location: $here");
exit;
}
function sql_clean($value) {
if(get_magic_quotes_gpc()) {
$value = stripslashes($value);
}
$value = mysql_real_escape_string($value);
return $value;
}
if($_POST['register']) {
$username = sql_clean(trim($_POST['username']));
$email = sql_clean(trim($_POST['email']));
if(strlen($username) < 5) {
$error[] = 'Your username must be at least 5 characters.';
}
if((strlen($_POST['password']) < 5) || (strlen($_POST['confirm']) < 5)) {
$error[] = 'Your password must be at least 5 characters.';
} elseif ($_POST['password'] != $_POST['confirm']) {
$error[] = 'Your passwords do not match.';
} else {
$password = md5($_POST['password']);
}
if(!preg_match( "/^(([^<>()[\]\\\\.,;:\s@\"]+(\.[^<>()[\]\\\\.,;:\s@\"]+)*)|(\"([^\"\\\\\r]|(\\\\[\w\W]))*\"))@((\[([0-9]{1,3}\.){3}[0-9]{1,3}\])|(([a-z\-0-9áàäçéèêñóòôöüæøå]+\.)+[a-z]{2,}))$/i", $email)) {
$error[] = 'That doesn\'t appear to be a valid email address.';
}
if(is_null($error)) {
mysql_query("INSERT INTO users(username, password, email) VALUES('$username', '$password', '$email')");
if(mysql_affected_rows() == 1) {
$_SESSION['isloggedin'] = true;
$_SESSION['username'] = $username;
header("Location: $here");
exit;
} else {
$error[] = 'The username and/or the email address you specified is already in use.';
}
}
}
if($_POST['login']) {
$username = sql_clean(trim($_POST['username']));
$password = md5($_POST['password']);
$result = mysql_query("SELECT username FROM users WHERE username = '$username' AND password = '$password'");
if (mysql_num_rows($result) == 1) {
$_SESSION['isloggedin'] = true;
$_SESSION['username'] = $username;
header("Location: $here");
} else {
$error[] = 'Wrong username/password. Please try again.';
}
}
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
"http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title></title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css">
label {
width: 8em;
float: left;
text-align: right;
margin-right: 0.5em;
display: block;
}
</style>
</head>
<body>
<?php
if($_SESSION['isloggedin'] === true) {
echo '<p>Welcome '.$_SESSION['username'].'</p>';
echo '<p>At this point we should re-direct the page or something...</p>';
echo '<p><a href="'.$here.'?do=logout">Logout</a></p>';
} else {
if(is_array($error)) {
echo "<p>The following errors were found -</p>";
foreach($error as $value) {
echo '<p>'.$value.'</p>';
}
}
if($_GET['do'] == 'register') {
echo '<form action="" method="post">';
echo '<p><label>Username:</label><input type="text" name="username" value="'.$_POST['username'].'"></p>';
echo '<p><label>Password:</label><input type="password" name="password"></p>';
echo '<p><label>Confirm password:</label><input type="password" name="confirm"></p>';
echo '<p><label>Your email:</label><input type="text" name="email" value="'.$_POST['email'].'"></p>';
echo '<p><label> </label><input type="submit" name="register" value="Submit"></p>';
echo '</form>';
} else {
echo '<form action="" method="post">';
echo '<p><label>Username:</label><input type="text" name="username" value="'.$_POST['username'].'"></p>';
echo '<p><label>Password:</label><input type="password" name="password"></p>';
echo '<p><label> </label><input type="submit" name="login" value="Submit"></p>';
echo '</form>';
echo '<p>Don\'t have an account? Click <a href="'.$here.'?do=register">here</a> to register.';
}
}
?>
</body>
</html>sorry no comments but it's fairly basic i think.
Last edited:
