PHP Signup form not working

Question

I want to make a simple signup form using PHP/MYSQL. However, when I submit the form, it doesn't add the user to the database. Would be glad if someone can find the solution. Here is my HTML:

<form action="signup.php" method="POST">

<label>Pick a username: </label><input type="text" name="username" /> <br>
  <label>Pick a password: </label><input type="password" name="password" /> <br>
  <label>Verify password: </label><input type="password" name="verify_password" /> <br>
  <label>Email address: </label><input type="text" name="email" /> <br>
  <button type="submit">Sign Up</button>

</form>

And signup.php:

<?php
include 'db.php';

$username = $_POST['username'];
$password = $_POST['password'];
$verify_password = $_POST['verify_password'];
$email = $_POST['email'];

 if ($verify_password !== $password) {
    echo "You didn't type your password correctly!";

} else {
    $sql = "INSERT INTO users (username, password, verify_password, email) 
    VALUES ('$username', '$password', '$verify_password', '$email')";

    $rezultat = mysqli_query($link, $sql);

    header("Location: index.php");
}
?>

EDIT: Here is the db.php:

<?php
define ("MYSQL_HOST", "localhost");
define ("MYSQL_USER", "root");
define ("MYSQL_PASS", "");
define ("MYSQL_DBNAME", "registrationTest");

function connect() {
    global $link;

    $link = mysqli_connect(MYSQL_HOST, MYSQL_USER, MYSQL_PASS, MYSQL_DBNAME) or die ("Connection error: " . mysqli_connect_error);
}
?>

Answer 1

Seeing you added your connection file in an edit:

Your connection file contains a custom function called connect() but you never called it.

function connect() {
    global $link;

    $link = mysqli_connect(MYSQL_HOST, MYSQL_USER, MYSQL_PASS, MYSQL_DBNAME) or die ("Connection error: " . mysqli_connect_error);
}

Either you remove:

function connect() {
    global $link;

}

Or call the function inside your script where you would like it to happen.

I.e.:

<?php
include 'db.php';

echo connect();

// ... rest of your code

• Note: I won't repeat what's been said in regards to the security of your code.

Edit: Nor will I do a total rewrite for a prepared statement and using a safe password hashing function; it's not my job.

• I "answered" the question, period.

I will however, include references for them to learn and do it themselves:

• http://php.net/manual/en/mysqli.prepare.php
• http://php.net/manual/en/function.password-hash.php

---

Change the following to check if the result was successful. If not, return the error if there is one:

else {
    $sql = "INSERT INTO users (username, password, verify_password, email) 
    VALUES ('$username', '$password', '$verify_password', '$email')";

    $rezultat = mysqli_query($link, $sql);

    header("Location: index.php");
}

to:

else {
    $sql = "INSERT INTO users (username, password, verify_password, email) 
    VALUES ('$username', '$password', '$verify_password', '$email')";

    $rezultat = mysqli_query($link, $sql);
}

if($rezultat){

    header("Location: index.php");
    exit;

}else{
    echo "Error: " . mysqli_error($link);
}

Answer 2

Below is a simplified code that you can even re-use any number of times for any number of projects by just simply editing the database values.

Below should be your db.php file

<?php
    function db_connect () {
        $link = @mysqli_connect ( 'localhost', 'username', 'password', 'table_name' );

        if ( mysqli_connect_errno () )
            die ( 'Failed to connect to server.' );
        return $link;
    }
?>

This file can now be simply called in any .php file. In your case, it is the Signup Script. Before that, below should be your HTML.

<form action="signup.php" method="POST">

<label>Pick a username: </label><input type="text" name="username" /> <br>

//Note that I have added "ID" to Password and Verify Password. This will be used to match the passwords before even submit.  
<label>Pick a password: </label><input type="password" id="password" name="password" /> <br>
  <label>Verify password: </label><input type="password" id="verify_password" name="verify_password" /> <br>
  <label>Email address: </label><input type="text" name="email" /> <br>

//Note that I have added "Name" to the Button. This will be used in the sign-up script for validation. The script is called by onclick where Javascript fucntion is called.
<button name="singup-details" type="submit" onclick="registerFunction()">Sign Up</button>

</form>

It is recommended to match the passwords via Javascript rather than in your PHP signup script. This stops the user from submitting the form in case the passwords don't match.

Below is the Javascript code you can past just before the </body> tag.

<script type="text/javascript">
    //This will set passwordmatch variable on password and verify_password change.
    $('#password, #verify_password').on('keyup', function () {
    if ($('#password').val() == $('#verify_password').val()) {
      $('#message').html('').css('color', 'green');

      passwordmatch = 'yes';
    } else {
      $('#message').html(' Enter the Password again. Both the fields must match.').css('color', 'red');

      passwordmatch = 'no';
    }
});

//If password matches, it will prompt to ensure that if the entries are correct. Or else, will set the focus to Password field.
    function registerFunction() {
        if (passwordmatch == 'yes') {
          if (confirm('You are about to change your password.\nPress OK to proceed.')) return false;

          $( "#userpassword" ).focus();
          $( "#userpassword" ).select();

          event.preventDefault();
        } else {
          alert('Password do not match. Please check and try again.');

          $( "#userpassword" ).focus();
          $( "#userpassword" ).select();

          event.preventDefault();
        }
    }
</script>

Now finally is your signup.php that needs to be changed.

<?php
    session_start();
    ob_start();

    //You can set timezone in order if you plan to store the registration time as well.
    date_default_timezone_set('Asia/Dubai');

    include 'db.php';


    $username = $_POST['useremail'];

    $password = $_POST['password'];

    $email = $_POST['email'];

    //Saving the password directly is not safe. It is better to encrypt it using, at least, SHA1. Below is the way to encrypt the password.
    $password = sha1($_POST['userpassword']);

    //By checking isset $_POST of the singup button of HTML using its name value, we ensure that the user can browse this page only by filling in the Singup form or else will be sent back to the Signup form.
    if (isset($_POST['singup-details'])) {
        //This is the way you can check that if the user exists or not.
        $sql = "SELECT * FROM your_table WHERE email = '" . $email . "'";
        $result = mysqli_query(db_connect(), $sql);

        $num_row = mysqli_num_rows($result);

        if( $num_row >= 1 ) {
            //If username exists, it will take back to the singup form.
            ?>
                <script language="javascript" type="text/javascript">
                    alert('<?php echo $username; ?> already exists in our records.\nTry Again.');
                    window.location = 'your_signup_form.php';
                </script>
            <?php
        }
        else {
            //If username doesn't exist it will save it into the database. Also note that you do not have to save the Verify Password. It is not required at all.
            $sql1 = "INSERT INTO table_name (username, email, password)
            VALUES ('$username', '$email', '$password')";

            $result1 = mysqli_query ( db_connect(), $sql1 );

            ?>
                <script language="javascript" type="text/javascript">
                    alert('Thank you <?php echo $username; ?> for registering.');
                    window.location = 'any_page_you_want.php';
                </script>
            <?php
        }
    }
    else {
        //In case someone tries to access this page directly, this will take him to the singup page instead.
        ?>
        <script language="javascript" type="text/javascript">
            window.location = 'your_signup_form.php';
        </script>
        <?php
    }
?>

Hope this helps. Happy coding...