The password not sotored and problem ocurred
Hi
I did run this code it did store the user name but not the password and this occurred the fields username and password in the database same us query filed name. this message bellow ocurred
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '= 'lana' AND password = (PASSWORD(''))' at line 1
PHP Code:
<?php // script to process the registration
// initialize variable and register broweser
session_start();
ob_start();
// file contain connection to the database
include "conn.inc.php";
?>
<html>
<head><title>Management System</title></head>
<body>
<?php
// check for if the user already exist and make sure the field not empty.
if(isset($_POST['submit']) && $_POST['submit'] == "Register")
{
if ($_POST['username'] != "" && $_POST['password'] != "")
{
//create SQL query
$query = "select username from user " . "where username = '" . $_POST['username'] . "';";
//mysql_query($sql) or die(mysql_error());
#excute the query
$result = mysql_query($query)
or die(mysql_error());
if (mysql_num_rows($result) != 0)
{
?>
<p>
<font color="Red"> <b>The Username,
<?php echo $_POST['username']; ?>, is already in use Please choose another
</b></font>
<form action="register.php" method="POST">
Username : <input type="text" name="username"> <br>
Password : <input type= "password" name="password" value="<?php echo $_POST['password']; ?>"><br>
<input type="submit" name="submit" value="Register">
<input type="reset" value="Clear">
</form>
</p>
<?php
}
else
{
//create SQL query
$query= "insert into user (username, password) " . "values ( '" . $_POST['username'] . "', " .
"password('" . $_post['password'] . "'));";
if ($query)
{
echo "the query ok";
}
// Excute query
$result = mysql_query($query)
or die(mysql_error());
$_SESSION['user_logged'] = $_POST['username'];
$_SESSION['user_password'] = $_POST['password'];
?>
<P>
Thank you, <?php echo $_POST['username']; ?> for Registering <br>
<?php
header("Refresh: 5; URL=index1.php");
echo "Your regiseration is complete" .
"You are being sent to the request page<br>";
echo "(if your browser doesn't support this, " .
"<a href=\"index1.php\"> Click here</a>)";
die();
}
}else
{
?>
<P>
<font color = "red"> <b>The Username and password required</b></font>
<form action="register.php" method="POST">
Username : <input type="text" name="username" value="<?php echo $_POST['username']; ?>"><br>
Password : <input type="password" name="password" value="<?php echo $_POST['password']; ?>"><br>
<input type="submit" name="submit" value="Register">
<input type="reset" value="Clear">
</form>
</P>
<?php
}
}else
{
?>
<p>
Welcome to Registeration<br>
Username and password required
<form action="register.php" method="POST">
Username : <input type="text" name="username"><br>
Password : <input type="password" name="password"><br>
<input type="submit" name="submit" value="Register">
<input type="reset" value="Clear">
</form>
</p>
<?php
}
?>
</body>
</html>
Re: The password not sotored and problem ocurred
replace this:
PHP Code:
$query= "insert into user (username, password) " . "values ( '" . $_POST['username'] . "', " .
"password('" . $_post['password'] . "'));";
with
PHP Code:
$username = $_POST['username'];
$pass = PASSWORD($_POST['password'];
$query= "INSERT INTO `user` (username, password) values ( '$username', '$pass')";
Re: The password not sotored and problem ocurred
Oh dear. Both of those are equally vulnerable to SQL injection attacks.
You really should use a proper data access library. mysqli is easiest; or you can use MDB2 (for PHP 4) or PDO (for PHP 5). These will allow you to use parameterised queries, which avoids any chance of SQL injection (and cuts down on typos, among other things).
