My Code does not add registration data into database

Question

I am trying to store registration data into database but something I cannot quite understand keeps happening, the line below which is in my register.php form is printed out first before the HTML loads

query($sql) === TRUE) { echo "New record created successfully"; } else { echo "Error: " . $sql . " " . $dbcon->error; } $dbcon->close(); } } ?>

Here is my code and I also would like to check if the email being used is registered, which in that case one should get an error saying 'Email is already registered'

Here is my PHP Code:

<?php
session_start();
if(isset($_SESSION['user'])!="")
{
    header("Location: index.php");
}

include_once 'dbconnect.php';

if(isset($_POST['signup']))
{
    //performing verfication
    $upass = $_POST['upass'];
    $pass2 = $_POST['pass2'];

    if ($upass == $pass2){

            $fullName=mysqli_escape_string($_POST['fullName']);
            $tphon=mysqli_escape_string($_POST['telephone']);
            $email=mysqli_escape_string($_POST['email']);
            $role=mysqli_escape_string($_POST['role']);
            $upass=mysqli_escape_string($upass);
            $pass2=mysqli_escape_string($pass2);

            $upass = crypt($upass);

            $sql = "INSERT INTO users (fullname, telephone, email, role, pass)
            VALUES ('$fullName', '$tphon', '$email', '$role', '$upass')";

            if ($dbcon->query($sql) === TRUE) {
                echo "New record created successfully";
            } else {
                echo "Error: " . $sql . "<br>" . $dbcon->error;
            }

            $dbcon->close();

        }
 }   
?>

and here is my HTML form:

    <form id="wizardForm" action="register.php" method="POST">
   <div class="row m-b-lg">
      <div class="col-md-4 center">
         <div class="login-box">
            <a href="register.php" class="logo-name text-lg text-center">Timewise</a>
            <p class="text-center m-t-md">Enter the following Details to Register</p>
         </div>
         <div class="form-group col-md-12">
            <label for="exampleInputName">Full Name</label>
            <input type="text" class="form-control" name="fullName" id="exampleInputName" placeholder="Full Name">
         </div>
         <div class="form-group  col-md-12">
            <label for="telephone">Telephone</label>
            <input type="text" class="form-control" name="telephone" id="telephone" placeholder="Telephone" >
         </div>
         <div class="form-group col-md-12">
            <label for="exampleInputEmail">Email Address</label>
            <input type="email" class="form-control" name="email" id="exampleInputEmail" placeholder="Enter email" >
         </div>
         <div class="form-group col-md-12">
            <label for="role">Role</label>
            <input type="radio" name="role" value="N" /> NORMAL <input type="radio" name="role" value="C" /> COMPANY <br/>
         </div>
         <div class="form-group col-md-12">
            <label for="exampleInputPassword1">Password</label>
            <input type="password" class="form-control" name="upass" id="exampleInputPassword1" placeholder="Password" >
         </div>
         <div class="form-group col-md-12">
            <label for="exampleInputPassword2">Confirm Password</label>
            <input type="password" class="form-control" name="pass2" id="exampleInputPassword2" placeholder="Confirm Password">
         </div>
         <div class="form-group col-md-12">
            <input type="submit"  name="signup" value="Submit" class="btn btn-success btn-block">
         </div>
         <p class="no-s text-center">2015 &copy; Timewise Errand Services</p>
      </div>
   </div>
</form>

Kindly help!!!

Answer 1

if (password1 == password2){

must be

if ($upass == $pass2 ){

As you don't have such variables in your script. And your INSERT query must be:

$sql = "INSERT INTO users (fullname, telephone, email, role, pass)
            VALUES ('$fullName', '$tphon', '$email', '$role', '$upass')";

assuming that $upass is a string.

Answer 2

As per seen/discussed in comments:

You were running your file as c:///file.php as opposed to http://localhost/file.php, hence why it was showing you code, rather than parsing it.

Then mysqli_escape_string() that function requires a database connection be passed and as the first parameter:

Consult:

• http://php.net/manual/en/function.mysqli-escape-string.php

Your session's conditional statement will give you a false positive:

if(isset($_SESSION['user'])!="")

which is interpreted as "if is set session array does not equal to"...

As opposed to "if the session array is set AND does not equal to"...

if(isset($_SESSION['user']) && $_SESSION['user'] != '')

Your edit with the form seems to be missing the closing </form> tag, and is unknown if the element for this conditional statement if(isset($_POST['signup'])) does indeed hold the same name attribute for it.

Plus, the inputs for the following POST arrays, were also not included in your edit for the HTML form:

$upass = $_POST['upass'];
$pass2 = $_POST['pass2'];

Check for errors via PHP, since you're already checking with MySQL.

Add error reporting to the top of your file(s) which will help find errors.

<?php 
error_reporting(E_ALL);
ini_set('display_errors', 1);

// Then the rest of your code

Sidenote: Displaying errors should only be done in staging, and never production.

---

Footnotes:

You should add exit; after header, otherwise your code may want to continue to execute.

header("Location: index.php");
exit;

---

Passwords

Use one of the following:

• CRYPT_BLOWFISH
• crypt()
• bcrypt()
• scrypt()
• On OPENWALL
• PBKDF2
• PBKDF2 on PHP.net
• PHP 5.5's password_hash() function.
• Compatibility pack (if PHP < 5.5) https://github.com/ircmaxell/password_compat/

Other links:

• PBKDF2 For PHP

Important sidenote about column length:

If and when you do decide to use password_hash() or crypt, it is important to note that if your present password column's length is anything lower than 60, it will need to be changed to that (or higher). The manual suggests a length of 255.

You will need to ALTER your column's length and start over with a new hash in order for it to take effect. Otherwise, MySQL will fail silently.

Same thing goes for using the crypt() function. The column's length needs to be long enough in order to accommodate the hash.

---