-3

I'm working on this project of registration form to be made in php was working before but now when i click on submit it just refresh the page or not working i checked phpmyadmin (xampp) multiple times but still not showing any data + no error showing on page either. There was some error on xampp didn't let me run mysql socket so i had to re-install the app now mysql seems to be fine. here is my php code and html body:

<?php
session_start();
//include_once 'assets/checkLogout.php';
include 'assets/connect.php';
global $conn;
$username = "";
$email = "";
$password = "";
$ConfPassword = "";
$errors = array();

if(isset($_POST['btnSubmit'])){
    $name = mysqli_real_escape_string($conn,$_POST['inputName']);
    $email = mysqli_real_escape_string($conn, $_POST['inputEmail']);
    $password = mysqli_real_escape_string($conn, $_POST['inputPassword']);
    $ConfPassword = mysqli_real_escape_string($conn, $_POST['confPassword']);
    checkPass($password,$ConfPassword,$name,$email);
}

function checkPass(string $password,string $ConfPassword,string $username,string $email){
    global $errors;
    if($password === $ConfPassword){
        checkUsername($password,$username,$email);
    }else{
        array_push($errors, "passwords do not match");
    }
}

function checkUsername(string $password,string $username,string $email){
    global $errors;
    global $conn;
    $user_check_query = "SELECT * FROM users WHERE email='$email' LIMIT 1";
    $result = $conn->query($user_check_query);
    $user_check = mysqli_fetch_assoc($result);
    if($user_check){
        if ($user_check['email'] === $email) {
            array_push($errors, "email already exists");
        }else{
            regUser($password,$username,$email);
        }
    }
}

function regUser(string $password,string $username,string $email){
    global $errors;
    global $conn;
    if (count($errors) == 0) {
        $newPass = password_hash($password, PASSWORD_BCRYPT);
        $regQuery = "INSERT INTO users (username,email,password) VALUES ('$username','$email','$newPass')";
        $conn->query($regQuery);
        $_SESSION['email'] = $email;
        $_SESSION['success'] = "You are now logged in";
        if ($conn->query($regQuery) === TRUE) {
            echo "<script>alert('User Registration Success!')</script>";
            header('location: index.php');
        } else {
            array_push($errors,'User Registration Failed!');
        }
    }
}

?>

Note: connect.php just has basic infos about mysql and check connection php code checks if 1)Both passwords are same 2)if email is already in database then hash the password with bcrypt and post data into name,email,password fields.

As far as i debug code only POST method is not working i tested password confirmation and is working, then tested if email is already taken is working (throwing errors as expected if not) ONLY the part where Registration takes place is not working

HTML Body:


    <div id="form-controller">
        <h4>Registration is open!</h4>
        <form method="post" action="registration.php">
            <?php include('assets/errors.php'); ?>
            <label>Name:</label>
            <input type="text" class="form-control" value="<?php echo $username?>" required name="inputName" placeholder="Name" style="padding-top: 1%; margin-top: 2%">
            <label>Email:</label>
            <input type="email" class="form-control" value="<?php echo $email?>" required name="inputEmail" placeholder="Email ID" style="padding-top: 1%; margin-top: 2%">
            <label>Password:</label>
            <input type="password" class="form-control" value="<?php echo $password ?>" required name="inputPassword" placeholder="Input Password" style="padding-top: 1%; margin-top: 2%">
            <label>Confirm Password:</label>
            <input type="password" class="form-control" value="<?php echo $ConfPassword ?>" required name="confPassword" placeholder="Confirm Password" style="padding-top: 1%; margin-top: 2%">
            <button type="submit" class="btn btn-success" name="btnSubmit" style="margin-top: 1.5%">Sign Up</button>
        </form>
        <form method="get" action="login.php">
            <button type="submit" class="btn btn-danger" style="margin-top: 1.5%">Already have account?</button>
        </form>
        <br><p><b><i>Note: for teacher's registration create account and contact administrator</i></b></p>
    </div>
  • Your button doesn't have a value. – miken32 Jun 09 '21 at 17:21
  • @miken32 tried but didn't work – Sumit kumar Jun 09 '21 at 17:28
  • submit button works when passwords do not match just POST method is not working – Sumit kumar Jun 09 '21 at 18:07
  • 1
    You are just firing off the query, but you don’t care whether it actually succeeded or not, at all. How to check if it succeeded, and how to get a proper error message if not - that has been explained countless times already, so please go and inform yourself about these absolute basics. (Most likely your query here fails, because you are using a reserved word as a column name, but without having escaped it properly.) – CBroe Jun 10 '21 at 07:28
  • 1
    **Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/5741187) – Dharman Jun 10 '21 at 11:16

1 Answers1

0

Turned out hashing had some problems in my code, I'm still trying to get around this bcrypt situation to verify (hope I'll look into it).

Thanks for inputs to use prepared statement: it was kind of new to this (haven't coded php in a while i think 2-3 years).

lemon
  • 2,990
  • 8
  • 28