PHP - Account creation mit Sicherheitsfrage

<center>
<?php


include 'config.php';

error_reporting(E_ALL ^ E_NOTICE);



$msg = Array();
$error = Array();

function addUser(){
if (empty($_POST)) return false;
global $config, $db, $msg, $error;


# Valid Email: [Only registered and activated users can see links. Click Here To Register...]
$pattern_email='^([a-zA-Z0-9._-]+)@((\[[0-9a-zA-Z]{1,3}\.[0-9a-zA-Z]{1,3}\.[0-9]{1,3}\.)|(([a-zA-Z0-9\-]+\.)+))([a-zA-Z]{2,4}|[0-9]{1,3})(\]?)$';
# Valid String: abc123
$pattern_string='^[0-9a-zA-Z]';

if (empty($_POST['login'])) $error[] = 'Error, You forgot to enter an account name!';
if (empty($_POST['password'][0]) || empty($_POST['password'][1])) $error[] = 'Error, You forgot to enter a password!';
if ($_POST['password'][0] !== $_POST['password'][1]) $error[] = 'Password does not match!';
if (empty($_POST['email']) || !ereg($pattern_email, $_POST['email'])) $error[] = 'Please fill in a valid email adress!';
if (!empty($error)) return false;

# Extra Checks - To enable uncomment the following
#define("STRING_CHECK", 1);

if(defined("STRING_CHECK"))
{
if (!ereg($pattern_string, $_POST['login'])) $error[] = 'Error, Your account name contains invalid letters!';
if (!ereg($pattern_string, $_POST['password'][1])) $error[] = 'Error, Your password contains invalid letters!';
if (!empty($error)) return false;
}

# Gather Password & IP
# $encrypted_password = sha1($_POST['password'][1]);
$v_password = sha1(strtoupper($_POST['login']).":".strtoupper($_POST['password'][1]));
$ip = $_SERVER['REMOTE_ADDR'];

include 'config.php';

# Connect to database
$db = @mysql_connect($Metin2_Host, $Metin2_User, $Metin2_Passwort);
if (!$db) return $error[] = 'Database: '.mysql_error();
if (!@mysql_select_db($Metin2_Account_DB, $db)) return $error[] = 'Database: '.mysql_error();

# Check account limit for IP address
if($Metin2_MaxIPs > 0)
{
$UserCheck = mysql_query("SELECT * FROM account WHERE last_ip = '$ip'");
if (mysql_num_rows($UserCheck) >= $Metin2_MaxIPs) return $error[] = '<font size=2 face=Tahoma><br /><b> Du hast bereits einen Account mit der IP!</b></font>';
}


# Check username is not in use already
$query = "SELECT `id` FROM `account` WHERE `login` = '".mysql_real_escape_string($_POST['login'])."' LIMIT 1";
$res = mysql_query($query, $db);
if (!$res) return $error[] = 'Database: '.mysql_error();
if (mysql_num_rows($res) > 0) return $error[] = 'Username already in use.';



//Fix For Double Digits by `Angel
if($Metin2_EncryptedPass > 0)
$query = "INSERT INTO `account` (`id`, `login`, `password`, `email`, `last_ip`) VALUES (NULL, '".mysql_real_escape_string($_POST['login'])."', '$v_password', '".mysql_real_escape_string($_POST['email'])."', '".$_SERVER['REMOTE_ADDR']."')";
else
$query = "INSERT INTO `account` (`id`, `login`, `password`, `email`, `last_ip`) VALUES (NULL, '".mysql_real_escape_string($_POST['login'])."', '".mysql_real_escape_string($_POST['password'][1])."', '".mysql_real_escape_string($_POST['email'])."', '".$_SERVER['REMOTE_ADDR']."')";

$res = mysql_query($query, $db);
if (!$res) return $error[] = 'Database: '.mysql_error();
$msg[] = 'Der Account <span style="color:#00FF00"><strong>'.htmlentities($_POS T['login']).'</strong></span> wurde Erfolgreich Erstellt!<br>Du kannst dich nun sofort Einloggen.';
return true;
}
if(!empty($_POST)){
addUser();
}

@mysql_close($db);

?>






<script defer type="text/javascript" src="pngfix.js"></script>





<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="POST">

<?php
if (!empty($error)){

foreach($error as $text)
echo $text.'';
};
if (!empty($msg)){

foreach($msg as $text)
echo $text.'';
};
?>


<table width="350" border="0" cellspacing="1" cellpadding="3">

<tr>
<th>Username: </th><td align="center"><input class="button" type="text" name="login" size="20" maxlength="16"/></td>
</tr>
<tr>
<th>Password: </th><td align="center"><input class="button" type="password" name="password[]" size="20" maxlength="16"/></td>
</tr>
<tr>
<th>Retype Password: </th><td align="center"><input class="button" type="password" name="password[]" size="20" maxlength="16"/></td>
</tr>
<tr>
<th>E-mail: </th><td align="center"><input class="button" type="text" name="email" size="20" maxlength="30"/></td>
</tr>


<br>
</table>
<input type="submit" value="Erstellen" class="button"/>
</form>

</center>