0

I am working on a simple sign up form for my site. Testing it on MAMP. Using ajax to send sign up info to a php file executing this code:

<?php

include("connection.php");

$username = "";
$pw = "";

$errorMsg = "";

function test_input($data) {
  $data = trim($data);
  $data = stripslashes($data);
  $data = htmlspecialchars($data);
  return $data;
}

if ($_POST["submit"] == "Sign Up!")
{
    if(!($_POST["username"]))
        $errorMsg .= "You must enter a user name. <br />";
    else if(strlen($_POST["username"]) < 3 OR strlen($_POST["username"]) > 8)
        $errorMsg .= "You user name must be between 3 and 8 characters long.<br />";
    else if(!ctype_alnum($_POST["username"]))
        $errorMsg .= "Your user name can contain only letters & numbers. <br />";
    else   
        $username = test_input($_POST["username"]);


    if(!($_POST["pw"]))
        $errorMsg .= "You must enter a password. <br />";
    else if(strlen($_POST["pw"]) < 8 OR strlen($_POST["pw"]) > 16)
        $errorMsg .= "Your password must be between 8 and 16 characters long.<br />";
    else if(!$_POST["confirmpw"])
        $errorMsg .= "You must confirm your password.<br />";
    else if($_POST["confirmpw"] != $_POST["pw"])
        $errorMsg .= "Your password confirmation doesn't match.<br />";
    else
        $pw = test_input($_POST["pw"]);

    if(!$errorMsg)
    {
        $query = "SELECT * FROM `userinfo` WHERE `username` ='".$username."'";
        $result = mysqli_query($connection001, $query);
        if (mysqli_num_rows($result) > 0)
            $errorMsg = "There is another account registered with this username. Do you want to log in?";
        else
        {
            $query = "INSERT INTO `userinfo` (`username`, `password`) VALUES ('".$username."', '".$pw."')";
            mysqli_query($connection001, $query);
        }                      
    }

    $data = array("username" => $username, "errorMsg" => $errorMsg);       
    echo json_encode($data); 

}

?>

It seems to work cause so far I manage to add entries to my table, but each time I do it I also get this error returned:

TypeError: field_id.match(...) is null

It seems to like it is related to how MAMP manages its database... Is it something I should be concerned about? If so could you kindly point me to a possible solution?

Jay Blanchard
  • 34,243
  • 16
  • 77
  • 119
Uknowho
  • 399
  • 2
  • 5
  • 18
  • 1
    Allow users to use the [passwords / phrases](https://xkcd.com/936/) they desire. [Don't limit passwords.](http://jayblanchard.net/security_fail_passwords.html) – Jay Blanchard May 10 '16 at 12:10
  • 1
    **Never store plain text passwords!** Please use PHP's [built-in functions](http://jayblanchard.net/proper_password_hashing_with_PHP.html) to handle password security. If you're using a PHP version less than 5.5 you can use the `password_hash()` [compatibility pack](https://github.com/ircmaxell/password_compat). Make sure that you [don't escape passwords](http://stackoverflow.com/q/36628418/1011527) or use any other cleansing mechanism on them before hashing. Doing so *changes* the password and causes unnecessary additional coding. – Jay Blanchard May 10 '16 at 12:10
  • 1
    [Little Bobby](http://bobby-tables.com/) says [your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! – Jay Blanchard May 10 '16 at 12:11
  • The error you post is not coming from your database because you do not return errors from your database. That looks more like a JavaScript error and there is no `field_id` in the code you've shared here. – Jay Blanchard May 10 '16 at 12:13
  • Thanks for all the comments guy! I am learning and so far I am just trying to have the flow of data from form to database to work correctly. I will surely implement security measure, and if you have a link to a tutorial with the proper procedure please post it here... Jay the error is being thrown by the phpMyadmin of map... – Uknowho May 10 '16 at 13:01
  • 1
    Then phpMyAdmin has a JavaScript error of some sort which is not effecting your PHP or your MySQL. As for links, look at the comments above - there are plenty there. – Jay Blanchard May 10 '16 at 13:03
  • Ok so not a consistent error to worry about... I am reading your links, thanks a lot! – Uknowho May 10 '16 at 13:10

0 Answers0