0

Ok, so I am creating an online multiplayer game and I have created the registration form.I couldn't really notice any problems with the code and was wondering if I could get some help.I write the username, password, email and I click "Register" and it comes up "Unknown Column 'name' in 'field list' Thank you:

<?PHP

//Database Information

$dbhost = "databasehost";
$dbname = "databasename";
$dbuser = "databaseusername";
$dbpass = "datebasepassword";

//Connect to database

mysql_connect ( $dbhost, $dbuser, $dbpass)or die("Could not connect: ".mysql_error());
mysql_select_db($dbname) or die(mysql_error());


$name = $_POST['name'];
$email = $_POST['email'];    
$username = $_POST['username'];
$password = ($_POST['password']);

// lets check to see if the username already exists

$checkuser = mysql_query("SELECT username FROM users WHERE username='$username'");

$username_exist = mysql_num_rows($checkuser);

if($username_exist > 0){
    echo "That name already exists.Try another";
    unset($username);
    include 'registration.html';
    exit();
}

// lf no errors present with the username
// use a query to insert the data into the database.

$query = "INSERT INTO users (name, email, username, password)
VALUES('$name', '$email', '$username', '$password')";
mysql_query($query) or die(mysql_error());
mysql_close();

echo "You are now registered!!!";

// mail user their information

$yoursite = 'www.foodworldvw.tk';
$webmaster = 'Jordan';
$youremail = 'simplyentertainingji@gmail.com';

$subject = "Thanks for registering at our website :)";
$message = "$username, you are now registered on Food World  
    To login, simply go to http://foodworldplay.tk and enter in the following details in the login form:
    Username: $username
    Password: $password

 $webmaster";

mail($email, $subject, $message, "From: $yoursite <$youremail>\nX-Mailer:PHP/" . phpversion());
echo "Thank you for registering with Food World.More information has been sent to your E-mail";
user1666767
  • 117
  • 3
  • 13
  • use ann backtip ( ` ) around the collum names. Also use mysqli_* or PDO for the database stuff, because mysql_* is deprecated... – Mathlight Jan 27 '13 at 21:27

1 Answers1

0

INSERT INTO users (name => INSERT INTO users (username

You should feel ashamed I know your database better than you

Also you have SQL Injection vulnerability in you code, and it's serious security issue.

You need to fix it asap.

Community
  • 1
  • 1
Peter
  • 16,453
  • 8
  • 51
  • 77