Website register question Sapphire 2.2

<?php if (!defined('access')) {die("Die gesuchte Ressource wurde entfernt oder umbenannt, oder sie steht vorübergehend nicht zur Verfügung.");} ?>
<p class="page_title"><?php echo $_LANG['regist_siteTitle']; ?></p>

<?php
if(isset($_POST['registSubmit'])) {
$account = cleanSqlInput($_POST['registAccountID']);
$pass1 = cleanSqlInput($_POST['registPassword']);
$pass2 = cleanSqlInput($_POST['registPasswordRepeat']);
$email = cleanSqlInput($_POST['registMail']);
$email2 = cleanSqlInput($_POST['registMailRepeat']);
$provider = preg_replace("^(.*?)@(.*?)^", "$2", $email);
$gefra = cleanSqlInput($_POST['registSecretQuestion']);
$geant = cleanSqlInput($_POST['registSecretAnswer']);
$md5pw = md5($_CONFIG['allg_svr_salt'].$pass1);
$strOutputErrorArray = array();
$accountcheck1 = @odbc_num_rows(@odbc_exec($odbc_connect, 'SELECT [account] FROM [' . $_CONFIG['db_databases']['acc'] . '].[dbo].[ACCOUNT_TBL] WHERE account = \''.$account.'\''));
$accountcheck2 = @odbc_num_rows(@odbc_exec($odbc_connect, 'SELECT [account] FROM [' . $_CONFIG['db_databases']['web'] . '].[dbo].[VALIDATE] WHERE [type] = 0 AND [account] = \''.$account.'\''));



if(!$_CONFIG['registration_enabled']) {
$strOutputErrorArray[] = $_LANG['error_registration_disabled'];
}
if(isSpamming($_POST['inputCheckTimestamp'], $_POST['inputCheckKey'], $_SESSION['inputCheckKey'])) {
$strOutputErrorArray[] = $_LANG['error_spam'];
}
if(empty($account) or empty($pass1) or empty($pass2) or empty($email) or empty($email2) or empty($gefra) or empty($geant)) {
$strOutputErrorArray[] = $_LANG['error_fill_in_all_fields'];
}
if(!isset($_POST['registCheckbox'])) {
$strOutputErrorArray[] = $_LANG['error_confirm_reading_rules'];
}
if($accountcheck1 > 0 OR $accountcheck2 > 0) {
$strOutputErrorArray[] = $_LANG['error_accountname_is_taken'];
}
if((strlen($account) > 16) || (strlen($account) < 3)) {
$strOutputErrorArray[] = $_LANG['error_account_length'];
}
if ($account != preg_replace ("/[^A-Za-z0-9]/", "", $account)) {
$strOutputErrorArray[] = $_LANG['error_no_special_characters_account'];
}
if((strlen($pass1) > 16) || (strlen($pass1) < 6)) {
$strOutputErrorArray[] = $_LANG['error_password_length'];
}
if($pass1 != $pass2) {
$strOutputErrorArray[] = $_LANG['error_passwords_indistinguishable'];
}
if($geant != preg_replace('/[^A-Za-z0-9 ]/', '', $geant)) {
$strOutputErrorArray[] = $_LANG['error_no_special_characters_secret_answer'];
}
if(strtolower($email) != strtolower($email2)) {
$strOutputErrorArray[] = $_LANG['error_mails_indistinguishable'];
}
if(!preg_match('/^[a-zA-Z0-9-_.]+@[a-zA-Z0-9-_.]+\.[a-zA-Z]{2,4}$/', $email)) {
$strOutputErrorArray[] = $_LANG['error_mail_must_be_valid'];
}
if(in_array($provider, $_CONFIG['web_mail_provider'])) {
$strOutputErrorArray[] = $_LANG['error_spam_provider'];
}
if(count($strOutputErrorArray) > 0) {
echo createMessage($strOutputErrorArray, 'fail');
}
else {
if(odbc_exec($odbc_connect, '
EXEC [' . $_CONFIG['db_databases']['acc'] . '].[dbo].[usp_createAccount] @account=\'' . $account . '\', @pw=\''.$md5pw.'\', @email=\''.$email.'\', @gefra=\''.$gefra.'\', @geant=\''.md5($_CONFIG['security_secretAnswerSalt'].$geant).'\', @ip = \'' . $_SERVER['REMOTE_ADDR'] . '\', @lang=\'' . $_CONFIG['web_default_lang'] . '\'
')) {
$_SESSION['user'] = strtolower($account);
$_SESSION['votepoints'] = 0;
$_SESSION['cash'] = 0;
echo createMessage('Der Account ' . cleanHtmlOutput($account) . ' wurde erfolgreich registriert.', 'success');
}
else {
echo createMessage('Der Account konnte nicht in die Datenbank geschrieben werden.', 'fail');
}
} 
}
else {
if($_CONFIG['registration_enabled']) {
if($_CONFIG['registration_verify_mail_enabled']) {
echo createMessage($_LANG['notify_registration'], 'hint');
}
}
else {
echo createMessage($_LANG['error_registration_disabled'], 'fail');
}
}
?>
<form method="post"><br />
<input type="hidden" name="inputCheckTimestamp" value="<?php echo time();?>" />
<input type="hidden" name="inputCheckKey" value="<?php echo random_string();?>" />
<fieldset>
<legend><?php echo $_LANG['regist_account_information_subTitle']; ?></legend>
<input type="text" name="registAccountID" id="registAccountID" maxlength="16" placeholder="<?php echo $_LANG['account']; ?>" required="required"/><label class="labelRegistration" for="registAccountID"><?php echo $_LANG['account']; ?> :</label><br />
<input type="password" name="registPassword" id="registPassword" placeholder="<?php echo $_LANG['password']; ?>" required="required"/> <input type="password" name="registPasswordRepeat" id="registPasswordRepeat" class="password" placeholder="<?php echo $_LANG['repeat_password']; ?>" required="required"/><label class="labelRegistration" for="registPassword"><?php echo $_LANG['password']; ?> :</label><br />
</fieldset>
<br />
<fieldset>
<legend><?php echo $_LANG['regist_security_subTitle']; ?></legend>
<input type="email" name="registMail" id="registMail" class="email" placeholder="[Only registered and activated users can see links. Click Here To Register...]" required="required"/> <input type="email" name="registMailRepeat" id="registMailRepeat" class="email" placeholder="<?php echo $_LANG['mail_repeat']; ?>" required="required"/><label class="labelRegistration" for="registMail"><?php echo $_LANG['mail']; ?> :</label>
<select name="registSecretQuestion" id="registSecretQuestion" class="frage" required="required">
<option value="" selected="selected"></option>
<?php 
foreach($_CONFIG['allg_secretquestions'] as $id => $frage) {
echo '<option value="'.$id.'" >'.$frage.'</option>';
}
?>
</select><label class="labelRegistration" for="registSecretQuestion"><?php echo $_LANG['secret_question']; ?> :</label><br />
<input type="text" name="registSecretAnswer" id="registSecretAnswer" class="antwort" placeholder="<?php echo $_LANG['secret_answer']; ?>" required="required"/><label class="labelRegistration" for="registSecretAnswer"><?php echo $_LANG['secret_answer']; ?> :</label>
</fieldset>
<br />
<fieldset>
<legend><?php echo $_LANG['regist_rules_subTitle']; ?></legend>
<input type="checkbox" name="registCheckbox" id="registCheckbox" style="margin:14px 10px;" required="required"/><label style="float:left;" for="registCheckbox"><?php echo $_LANG['regist_read_confirmation']; ?> </label><br /><br style="clear:both;"/>
</fieldset>
<input type="submit" name="registSubmit" value="<?php echo $_LANG['button_send_registration']; ?>" class="button_235" style="margin:10px 0px 10px 190px;" />
</form>

USE [ACCOUNT_DBF]
GO

/****** Object:  StoredProcedure [dbo].[usp_createAccount]    Script Date: 08/22/2013 12:08:16 ******/
IF  EXISTS (SELECT * FROM sys.objects WHERE object_id = OBJECT_ID(N'[dbo].[usp_createAccount]') AND type in (N'P', N'PC'))
DROP PROCEDURE [dbo].[usp_createAccount]
GO

USE [ACCOUNT_DBF]
GO

/****** Object:  StoredProcedure [dbo].[usp_createAccount]    Script Date: 08/22/2013 12:08:16 ******/
SET ANSI_NULLS ON
GO

SET QUOTED_IDENTIFIER ON
GO


CREATE proc [dbo].[usp_createAccount]
@account varchar(32),
@pw varchar(32),
@cash int = 0,
@email varchar(100) = '',
@gefra smallint = 0,
@geant varchar(50),
@ip varchar(39),
@lang varchar(3)
as
set nocount on
set xact_abort on

if not exists (select * from ACCOUNT_TBL where account = @account)
begin


	begin tran
	INSERT ACCOUNT_TBL(account,password,isuse,member,id_no1,id_no2,realname,OldPassword,cash)
	VALUES(@account, @pw, 'T', 'A', @pw, @pw, 'P',@pw, @cash)
	INSERT ACCOUNT_TBL_DETAIL(account,gamecode,tester,m_chLoginAuthority,regdate,BlockTime,EndTime,WebTime,isuse,secession, email,secretquestion,secretanswer,regIP)
	VALUES(@account,'A000','2','F',GETDATE(),CONVERT(CHAR(8),GETDATE()-1,112),CONVERT(CHAR(8),DATEADD(year,10,GETDATE()),112),CONVERT(CHAR(8),GETDATE()-1,112),'T',NULL, @email, @gefra, @geant, @ip)

	if @@error <> 0
	begin
		rollback tran
		select -1
	end
	else
	begin
		commit tran
		select 1
	end
end
else
begin
	select 0
end


GO

USE [ACCOUNT_DBF]
GO

/****** Object:  Table [dbo].[ACCOUNT_TBL_DETAIL]    Script Date: 05/07/2013 12:23:49 ******/
SET ANSI_NULLS ON
GO

SET QUOTED_IDENTIFIER ON
GO

SET ANSI_PADDING ON
GO

ALTER TABLE [dbo].[ACCOUNT_TBL_DETAIL] ADD
	[secretquestion] [smallint] NULL,
	[secretanswer] [varchar](50) NULL,
	[latestpassword] [varchar](32) NULL,
	[BanReason] [varchar](50) NULL,
	[regIP] [varchar](39) NULL,
	[lang] [varchar](3) NULL

GO

SET ANSI_PADDING OFF
GO