PHP & MYSQL: Register/Create an Account

Question

I have code for registering (using database as well). When I input information in the form and submit, nothing happens. Any help would be much appreciated! Thanks.

-after I fix this hopefully I can log in!

register.php

<!doctype html>
<html>
<head>
<title>Register</title>
</head>
<body>

<p><a href="register.php">Register</a> | <a href="login.php">Login</a></p>
<h3>Registration Form</h3>
<form action="" method="POST">
Username: <input type="text" name="user"><br />
Password: <input type="password" name="pass"><br /> 
<input type="submit" value="Register" name="submit" />
</form>
<?php
if(isset($_POST["submit"])){

if(!empty($_POST['user']) && !empty($_POST['pass'])) {
    $user=$_POST['user'];
    $pass=$_POST['pass'];

    $con=mysqli_connect('localhost','root','') or die(mysqli_error());
    mysqli_select_db('database') or die("cannot select DB");

    $query=mysqli_query("SELECT * FROM login WHERE username='".$user."'");
    $numrows=mysqli_num_rows($query);
    if($numrows==0)
    {
    $sql="INSERT INTO login(username,password) VALUES('$user','$pass')";

    $result=mysqli_query($sql);


    if($result){
    echo "Account Successfully Created";
    } else {
    echo "Failure!";
    }

    } else {
    echo "That username already exists! Please try again with another.";
    }

} else {
echo "All fields are required!";
}
}
?>

</body>
</html>

Database info:

CREATE TABLE IF NOT EXISTS `login` (
  `username` varchar(200) NOT NULL,
  `password` varchar(200) NOT NULL,
  PRIMARY KEY (`username`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8_general_ci;

You forgot to put a value in your action attribute: action="" I assume you want to send it to the same page, so I recommend using action="<?php echo htmlspecialchars($_SERVER[PHP_SELF]); ?>" and I highly recommend reading the manuals posted by Fred -ii-, given that your code is extremely hackable amongst other things. — Webeng
– Webeng, Commented May 7, 2016 at 0:46
@Webeng Good point on that ^ they are intending on using it as self but using htmlspecialchars($_SERVER[PHP_SELF]) is better. — Funk Forty Niner
– Funk Forty Niner, Commented May 7, 2016 at 0:47
yeah, XSS attacks are super common, and a simple http://www.example.com/<script>alert('hello')</script> written in the url to enter the site would already cause a breach. — Webeng
– Webeng, Commented May 7, 2016 at 0:51

Community · Accepted Answer · 2017-03-17 10:45:55Z

7

Read the manuals on both of the following:

mysqli_select_db() => http://php.net/manual/en/mysqli.select-db.php
mysqli_query() => http://php.net/manual/en/mysqli.query.php

That's why your code is failing. Both require a db connection and as the first parameter, it's all in there.

Plus, mysqli_error() also requires db connection be passed as a parameter.

mysqli_error() => http://php.net/manual/en/mysqli.error.php

While also checking for errors against your query; you're not doing that.

Sidenote about your connection.

You can actually get rid of mysqli_select_db() entirely, and just use all 4 parameters in mysqli_connect():

http://php.net/manual/en/function.mysqli-connect.php

Example from the manual:

$link = mysqli_connect("127.0.0.1", "my_user", "my_password", "my_db");

Passwords

I also noticed that you may be storing passwords in plain text. This is not recommended.

Use one of the following:

PHP 5.5's password_hash() function.
Compatibility pack (if PHP < 5.5) https://github.com/ircmaxell/password_compat/

Important sidenote about column length:

If and when you do decide to use password_hash() or the compatibility pack (if PHP < 5.5) https://github.com/ircmaxell/password_compat/, it is important to note that if your present password column's length is anything lower than 60, it will need to be changed to that (or higher). The manual suggests a length of 255.

You will need to ALTER your column's length and start over with a new hash in order for it to take effect. Otherwise, MySQL will fail silently.

2 Comments

tadman Over a year ago

That's quite a list of recommended password systems, but password_hash() should be #1 and the rest are on a "need to know" basis only. It's the only one that works reliably without a whole lot of specialized knowledge required.

Funk Forty Niner Over a year ago

You're right @tadman and I've made an edit. Thanks for the feedback, cheers

Collectives™ on Stack Overflow

PHP & MYSQL: Register/Create an Account

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related