[Help] Register Page Mysql

01/07/2014 10:10 Beb0mn#1
Greetings is been long time since I post here in the community. I was wondering if someone could help me out here, I am trying to edit a web page downloaded from elitepvpers (I searched for it and got a lot of sources but only one is doing what i really want which is a registration that identifies if the username exists or not and anti inject proof, as far as i know this one those the check for existing usernames, dont know about injection.) I have tried all possible ways including google, and even make up commands for mysql php codes and got nothing, the page loads but it wont send the values to the database.


If anyone please be so kind. db.config.php contains the database connection details, i know the one that needs to be fixed is this .php file to be launched

Thanks in advance.

P.S- Yes i have tried all the search results I get.
01/07/2014 11:27 Gerculy#2
I'm working on a script right now ( PDO ). If you are not in rush I might share it with you.
(Easy to use and secure)
01/07/2014 16:17 turk55#3
Here is one I wrote for [Only registered and activated users can see links. Click Here To Register...]

01/07/2014 16:27 Beb0mn#4
Gerculy, thanks, Looking forward to see what you came up with. I have no rush.


turk55, I will try it as soon as I get home, is it ok if I PM you if I run into issues?
01/07/2014 16:34 turk55#5
Quote:
Originally Posted by Beb0mn View Post
Gerculy, thanks, Looking forward to see what you came up with. I have no rush.


turk55, I will try it as soon as I get home, is it ok if I PM you if I run into issues?
Sure and I just took a look on your script, at the username check you basically say if I can run the query the username exists. This is not how you should do it.

Code:
}elseif($row = mysql_query($stmt)){ 
            $errors[] = 'User name already exists, please choose a different user name.'; 
        }
Try this instead :
Code:
}elseif($row = mysql_query($stmt)){ 
            if(mysql_num_rows($row) > 0) {
				$errors[] = 'User name already exists, please choose a different user name.'; 
			}
        }
Not to mention you are using a question mark ("?") at the query but you are not filling it in any way plus the question mark is only used at prepared statements (the regular mysql library does not support prepared statements, mysqli does).

$sql = "SELECT Username FROM 'accounts' WHERE Username = ?";
TO:
$sql = "SELECT Username FROM 'accounts' WHERE Username = \"".$username."\"";
01/07/2014 16:41 Gerculy#6
Here's my :) ( Little simpler compared to Insomnius one's )

Config ..


Register Page [ PHP + HTML ]




It looks like this if you use Bootstrap.



Bootstrap CDN

01/07/2014 20:39 Beb0mn#7
Quote:
Originally Posted by turk55 View Post
Sure and I just took a look on your script, at the username check you basically say if I can run the query the username exists. This is not how you should do it.

Code:
}elseif($row = mysql_query($stmt)){ 
            $errors[] = 'User name already exists, please choose a different user name.'; 
        }
Try this instead :
Code:
}elseif($row = mysql_query($stmt)){ 
            if(mysql_num_rows($row) > 0) {
				$errors[] = 'User name already exists, please choose a different user name.'; 
			}
        }
Not to mention you are using a question mark ("?") at the query but you are not filling it in any way plus the question mark is only used at prepared statements (the regular mysql library does not support prepared statements, mysqli does).

$sql = "SELECT Username FROM 'accounts' WHERE Username = ?";
TO:
$sql = "SELECT Username FROM 'accounts' WHERE Username = \"".$username."\"";
So all the other commands are ok except for the '?'? That source was from obdc database and i tried to change it to mysql. I dont know if the mysql calls are ok. I will do your sugestion as soon as i can.
Quote:
Originally Posted by Gerculy View Post
Here's my :) ( Little simpler compared to Insomnius one's )

Config ..


Register Page [ PHP + HTML ]




It looks like this if you use Bootstrap.



Bootstrap CDN

Sorry for the lack of knowledge, Do i add the bootstrap code on top of the php code in the same register page? Like style html code in html?

My thoughts are that i should since the register page is not making a call to a bootstrap.php, i just want to make sure.

Edit = I just realized everything goes in 1 uniqur register.php page. Nevermind the dumb question. I'm still wondering about the one below.

Also sorry for the demands, is it anti injection?
01/07/2014 21:01 Gerculy#8
Quote:
Originally Posted by Beb0mn View Post
Is it anti injection?
I did my best... Shouldn't have problems with it.
( A good hacker hacks anything :handsdown:)
01/07/2014 22:54 Beb0mn#9
Ok this is what i have done so far

For the register.php that contains the form


I can fill out the information and then after the submit button is pressed he calls this page - registersucessfull.php

it says error in line 98.

If i combine both pages into one it just gives me error Please supply all data!, even if the form has been filled completely.
01/08/2014 06:36 Gerculy#10
Remove else { from the end of the page .
That should fix it.

--
You also can remove the connection to database from register.php ( It's useless )

and ?page=1 ( Line 29 )
01/08/2014 08:44 Beb0mn#11
Thanks guys for the support

Thread can be close. Thank you again.