Cannot POST to my Mysql database using my HTML registration form: UPDATED CODE

Question

so im trying to create a registration form for my website and am using a SQL database using phpmyadmin. I have done a ton of research on how to create the PHP file that will add the User to my database after creating their account. To the best of my knowledge, i have the correct execution and code but when i go to my website, create a user and go to my phpmyadmin to check my database table to see if the user is created..it is not.Below i will include my code for connection php file along with my register.php file. At this point i have no idea as to what is wrong with my code that is not actually POSTing and data to the database after creating an account on my website.

Below is my UPDATED dbconnect.php file which is included in my register.php

    <?php 

/*** mysql hostname ***/
$hostname = 'localhost';
/*** mysql username ***/
$username = '******';
/*** mysql password ***/
$password = '******';



try {
function testdb_connect (){
    $dbh = new PDO("mysql:host=$hostname;dbname=*******", $username, $password);
return ($dbh);
}
$dbh = testdb_connect();
}
catch(PDOException $e) {
    echo $e->getMessage();
}

?>

Here is the UPDATED PHP section of register.php:

      <?php
session_start();
if(isset($_SESSION['User']))
{
 header("Location: home.php");
}
include_once 'dbconnect.php';

if(isset($_POST['submit']))
{
$uname = $_POST['uname'];
$email = $_POST['email'];
$upass = $_POST['upass'];

}
 $stmt = $dbh->prepare("SELECT COUNT(*) as `emailcount` FROM `User` WHERE email=:email");
 $stmt->execute(array("email" => $_POST['email']));
 $row = $stmt->fetch(PDO::FETCH_ASSOC);

if ($row['emailcount'] > 0) {
    echo "<script>alert('Email $email already exists in our system. Please try another email')</script>";
}


    $stmt = $dbh->prepare("INSERT INTO User(`uname`, `email`, `upass`) VALUES (:uname, :email, :upass)");

    $stmt->execute(array("uname" => $_POST['uname'], "email" => $_POST['email'], "upass" => md5($_POST['upass'])));






?>

And here is the UPDATED HTML form which creates the user account and is supposed to POST to my database table:

    <form method='post' action='register.php'>
                <pre>
                <div>
            <label>Name : (letters only)*</label>
<input type="text" name="uname" pattern="[A-Za-z]+" title="only letters" required />
</div>

<div>
<label>E-mail : (xyz@zyx.com)*</label>
<input type="email" name="email" pattern="[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,4}$" title="xyz@something.com" required />
</div>


<div>
<label>password : (at least 6 chars)</label>
<input type="password" name="upass" pattern=".{6,}" title="Six or more characters" required />
</div>



<input type='submit' name='submit' value='Sign Up'>
</pre>
</form>

Answer 1

There's a couple of things here that needs to be altered, let's start with your choice of API.

Mixing APIs and addressing prepared statements

This isn't something you can do in PHP. Your connection uses PDO, while your queries used the old and outdated mysql_* functions. I'd recommend you edit your code to reflect the connection rather than change the connection to the deprecated mysqli_*. You should also use prepared statements.

So instead of the line $run = mysql_query($check_email);, you'd do something like this, which will use the API you chose in your connection-code, and take advantage of prepared statements.

$stmt = $dbh->prepare("SELECT COUNT(*) as `emailcount` FROM `User` WHERE email=:email");
$stmt->execute(array("email" => $_POST['email']));
$row = $stmt->fetch(PDO::FETCH_ASSOC);

if ($row['emailcount'] > 0) {
    echo "<script>alert('Email $email already exists in our system. Please try another email')</script>";
}

And your insertion query would look something like this:

$stmt = $dbh->prepare("INSERT INTO User(`uname`, `email`, `upass`) VALUES (:uname, :email, :pass)");
$stmt->execute(array("uname" => $_POST['uname'], "email" => $_POST['email'], "pass" => md5($_POST['upass'])));

Also note that you used name="upass" in your form, but your PHP used $_POST['pass'], which are different, and they need to be the same.

Calling the function for your connection

In your connection file, you put the PDO object inside a function, which is fine, but you need to call it, either after you require the file, or in the connection file itself.

$dbh = testdb_connect();

EDIT: Per the comments, also discovered another issue with the variable-scope:

You're also facing some issues with variable scope, as you define the variables for your connection outside the function. The function can't see those variables, because they are not defined inside the function, passed as arguments or made global.

I strongly recommend you not use global variables, and instead pass them as arguments or define them inside the function. This example below have been modified to define them inside the function instead.

<?php 
// Define a function for the PDO object
function testdb_connect() {
    try {
        /*** mysql hostname ***/
        $hostname = 'localhost';
        /*** mysql username ***/
        $username = '--------';
        /*** mysql password ***/
        $password = '------';

        $dbh = new PDO("mysql:host=$hostname;dbname=databasename", $username, $password);
        return $dbh;
    } catch(PDOException $e) {
        echo $e->getMessage();
    }
}

$dbh = testdb_connect(); // call the function, create the connection
?>

The errors you provided in the comments suggests that the object was not created, which should now be fixed with the above code. I also restructured it a bit, putting the try/catch block in a more appropriate place.

Your submit-button

This is mainly why nothing happened. Your submit-button has no name, attribute, but two values instead. Which means that the line if(isset($_POST['submit'])) will never be true, because there is no input-element with that name.

Instead of

<input type='submit' value='submit' value='Sign Up'>

it should look like

<input type='submit' name='submit' value='Sign Up'>

False positives with isset

The line if(isset($_SESSION['User'])!="") would give you a false positive, as an isset() returns a boolean (true/false), which will never be equal to an empty string.

It should be if (isset($_SESSION['User'])) {, which will redirect the user only if he is signed in.

Additional notes

With the changes above, your checks for empty email/password should be slightly changed, as we will no longer need the lines you commented out (as those use the old mysql_real_escape_string() and we'll be using PDO instead, so they are not defined):

if (empty($_POST['uname'])) {
    echo "<script>alert('Please Enter Your name')</script>";
    exit();
}
if (empty($_POST['email '])) {
    echo "<script>alert('Please Enter Your Email')</script>";
    exit();
}

• Your password-hashing is md5, which is discouraged to use with passwords. You should look into using a function such as password_hash() instead.

• Enable error_reporting(E_ALL); when troubleshooting

Additional reading-material

• How can I prevent SQL-injection in PHP?

• Why shouldn't I use mysql_* functions in PHP?

Answer 2

You need to uncomment this:

$uname = mysql_real_escape_string($_POST['uname']);
$email = mysql_real_escape_string($_POST['email']);
$upass = md5(mysql_real_escape_string($_POST['pass']));

Answer 3

check post value of password field....& update it by $upass = md5(mysql_real_escape_string($_POST['upass']));

Answer 4

possible error apart form commented lines

1: is databasename your database name

2: PHP version > 5.5.0

3: input field has an escaped character and db setting dosnt accept NULL as value

dont use mysql_real_escape_string***

Answer 5

<input type="password" name="upass" pattern=".{6,}" title="Six or more characters" required/>

Since the name of input type password is 'upass', then you should assign 'upass' to your $upass variable. or change the name of input type to 'pass'.

It should be like this after submitting form

$upass = md5(mysql_real_escape_string($_POST['upass']));