2

I'm trying to create a login for a website. So far whenever I post to my database doesn't show the submitted information, the only things which are posted is a hashed password.

<form method="post" action="submit.php">
                        <div class="form-group">
                            <label for="email">Email:</label>
                            <input type="email" class="form-control" id="email">
                        </div>
                        <div class="form-group">
                            <label for="username">Username:</label>
                            <input type="text" class="form-control" id="username">
                        </div>
                        <div class="form-group">
                            <label for="password">Password:</label>
                            <input type="password" class="form-control" id="password">
                        </div>
                        <div class="form-group">
                            <label for="pwd2">Re-Password</label>
                            <input type="password" class="form-control" id="pwd2">
                        </div>
                        <div class="form-group">
                            <input type="submit" class="form-control" id="submit">
                        </div>
                    </form>

To submit into this php block

<?php
    $servername = "localhost";
    $username = "root";
   $password = "Password";
   $dbname = "DBNAME";


   $email = NULL;
   $user = NULL;
   $pass1 = NULL;

   if (isset($_POST['email'])){
   $email = $_POST['email'];
    }
   if (isset($_POST['username'])){
   $user = $_POST['username'];
   }

    if (isset($_POST['password'])){
   $pass1 = $_POST['password'];
   }
  $hash = password_hash($pass1, PASSWORD_BCRYPT);


   $conn = new mysqli($servername, $username, $password, $dbname);

   if ($conn->connect_error) {
   die("Connection failed: " . $conn->connect_error);
   } 

   $sql = "INSERT INTO Users (email, username, password )
   VALUES ('$email', '$user', '$hash')";

   if ($conn->query($sql) === TRUE) {
   echo "New record created successfully";
   } else {
   echo "Error: " . $sql . "<br>" . $conn->error;
    }

  $conn->close();
  ?>

1 Answer 1

3

Your form fields lack name attributes. Without them no values are sent your your script. This is easily testable by doing var_export($_POST).

<form method="post" action="submit.php">
    <div class="form-group">
        <label for="email">Email:</label>
        <input type="email" class="form-control" name="email" id="email">
    </div>
    <div class="form-group">
        <label for="username">Username:</label>
        <input type="text" class="form-control" name="username" id="username">
    </div>
    <div class="form-group">
        <label for="password">Password:</label>
        <input type="password" class="form-control" name="password" id="password">
    </div>
    <div class="form-group">
        <label for="pwd2">Re-Password</label>
        <input type="password" class="form-control" name="pwd2" id="pwd2">
    </div>
    <div class="form-group">
        <input type="submit" class="form-control" id="submit">
    </div>
</form>

FYI, you are wide open to SQL injections

Sign up to request clarification or add additional context in comments.

2 Comments

Thank you, it works, I'll start working on blocking SQL injections
Cool. You're off to a good start by using the new password functionality in PHP and using mysqli over mysql. Now you're ready to take it to the next level and prevent those darn sql injections.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.