0

I read a bit about the Post/Redirect/Get pattern and I'm not really sure how to apply it in PHP. Could someone please take this very simple example and explain it to me? Let's say you have a form and a user needs to register. After that he just gets redirected to another page. How do I make that so that it prevents adding duplicate content in the Database.

My Form

<form id="registerPage" method="POST" action="reg.php">
    <input id="username" name="username" type="text" placholder="username">
    <input id="password" name="password" type="password" placholder="password">
    <button type="submit">Register</button>
</form>

reg.php

<?php
    $username = $_POST['username'];
    $password= $_POST['password'];
    $encrypt= md5($password);

    $con = mysqli_connect("localhost","yo","sup","cool");

    $query = "INSERT INTO table(";
    $query .= "username,";
    $query .= "password)VALUES(";
    $query .= "'$username',";
    $query .= "'$password')";
    mysqli_query($con,$query);

    echo "<script>alert('Successfully Registered')</script>";

    mysqli_close($con);
?>
Cœur
  • 37,241
  • 25
  • 195
  • 267
Please Delete me
  • 807
  • 2
  • 10
  • 15
  • http://us2.php.net/manual/en/function.header.php – Martin Nov 15 '13 at 12:47
  • \o/ passwords **hashed** using the broken (for passwords) md5 – PeeHaa Nov 15 '13 at 12:47
  • @PeeHaa I don't understand the SQL injection part. MD5 has billions of permutations and is a one-way encryption. Could you elaborate on the SQL injection and how to remain protected from it? – Please Delete me Nov 15 '13 at 12:49
  • "MD5 has billions of permutations and is a one-way" Yes also you can guess it with billions of permutations per second – PeeHaa Nov 15 '13 at 12:51
  • 1
    @SabTheCoder Imagine this: `username='); DROP TABLE table; --`. Suddenly all your users are deleted and you have no idea why. MD5 is bad for passwords for several reasons. 1. There's lots of collisions and it's been broken for a while now. 2. There's a billion sites with a quick-index of reverse MD5 lookups. 3. You aren't even using a salt. 4. MD5 generation is quick, and while this should be good, it also means brute forcing is super easy. – h2ooooooo Nov 15 '13 at 12:51
  • Regarding the sql injection: http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php – PeeHaa Nov 15 '13 at 12:51
  • @h2ooooooo that doesn't work... – PeeHaa Nov 15 '13 at 12:53
  • @h2ooooooo But how can the person execute the DROP table without accessing my server? I wanted to know about the redirect thing, but now that this SQL thing came in I'm sure I will lose marks if my professor has the same views for this SQL vulnerability. Are there some tutorials on how to fix this? :S – Please Delete me Nov 15 '13 at 12:55
  • @PeeHaa Some mysqli implementations allow multiple queries. (Hmm.. at least I swear that I've read that somewhere..) – h2ooooooo Nov 15 '13 at 12:57
  • @SabTheCoder They don't have to access your server - you're allowing them direct access to execute **any query they want**. – h2ooooooo Nov 15 '13 at 12:58
  • ..as an addition, PeeHaa is completely [correct](http://php.net/manual/en/mysqli.quickstart.multiple-statement.php). I have no clue where I've obtained the information that it's possible with a different config. – h2ooooooo Nov 15 '13 at 13:04
  • Read this: [The Great Escapism (Or: What You Need To Know To Work With Text Within Text)](http://kunststube.net/escapism/) – deceze Nov 15 '13 at 13:05
  • Also OP have you searched for duplicates / have you checked the list of duplicates you got when typing in the title of your question? http://stackoverflow.com/questions/1678763/problem-with-my-implementation-of-the-post-redirect-get-pattern?rq=1 – PeeHaa Nov 15 '13 at 13:19

0 Answers0