1

I am getting the error message undefined variable for all of the following:

if(isset($_POST['nome'])){
    $name = $_POST['nome'];
}

if(isset($_POST['email'])){
    $email = $_POST['email']; 
}


if(isset($_POST['password'])){
    $password = $_POST['password']; 
}

If I use REQUEST instead of POST it works, but I read that is better to use POST for user forms.

Here is my entire php code:

<?php
 define('DB_HOST', 'localhost');
 define('DB_NAME', 'class_rate');
 define('DB_USER', 'root');
 define('DB_PASSWORD', 'vB42lL&69_r');

 $con = mysqli_connect(DB_HOST, DB_USER);
    if(!$con){
        die("Databese Connection Failed" . mysqli_error($con));
    }
 $db = mysqli_select_db($con, DB_NAME);
    if(!$db){
        die("Databese Selection Failed" . mysqli_error($con));
    }



   function NewUser($con, $db){

            if(isset($_POST['nome'])){
        $name = $_POST['nome'];
    }

    if(isset($_POST['email'])){
        $email = $_POST['email']; 
    }


    if(isset($_POST['password'])){
       $password = $_POST['password']; 
    }

    $query = "INSERT INTO users (nome_user,email_user,passw_user) VALUES ('$name','$email','$password')"; 
     $data = mysqli_query($con, $query)or die(mysqli_error($con)); 
    if($data) { 
        echo "YOUR REGISTRATION IS COMPLETED..."; 
    }
 }

function SignUp($con,$db){
     if (!empty($_POST['email'])) {
      $query = mysqli_query("SELECT * FROM users WHERE email_user = '$_POST[email]' AND passw_user = '$_POST[password]'") or die(mysqli_error($con));

       if(!$row = mysqli_fetch_array($query) or die(mysqli_error($con)) ){
            NewUser($con,$db);
       }
}

   else{
      echo "Email already registered!";
    }
}

   if($_SERVER['REQUEST_METHOD'] == "POST"){
      SignUp($con,$db);
   }


 ?>

I don't know if maybe my problem is with my HTML code for the form, so I will also include it here:

 <form action="cadastro.php" method="post">
        <label><b>Nome:</b></label>
        <div>
            <input type="text" placeholder="Nome" id = "nome"name="nome" required>              
        </div>
        <label><b>Email:</b></label>
        <div>
            <input type="email" placeholder="Email" id = "email "name="email" required>
        </div>
        <label><b>Confirmar Email:</b></label>
        <div>
            <input type="email" placeholder="Confirmar Email" id="confirmar_email" name="confirmar_email" required>     
        </div>
        <label><b>Universidade:</b></label>
        <div>               
            <input type="text" placeholder="Universidade" id="universidade" name="universidade" required>
        </div>
        <label><b>Curso:</b></label>
        <div>
            <input type="text" placeholder="Curso" id="curso" name="curso" required>
        </div>
        <label><b>Senha:</b></label>
        <div>
            <input type="password" placeholder="Senha" id="password" name="password" required>
        </div>
        <label><b>Confirmar Senha:</b></label>
        <div>
            <input type="password" placeholder="Confirmar Senha" id="confirmar_password" name="confirmar_password" required>
        </div>
        <input type="checkbox"> Ao apertar na caixa voce confirma que leu e conconrda com os <a href="#">Termos e Condicoes</a>.
        <div class="botoes">
            <button name = "sub" id = "sub" type="submit" class="signupbtn">Confirmar</button>
            <button name = "cancel" id = "cancel" type="button" class="cancelbtn">Cancelar</button>
        </div>
  </form>
Bruno
  • 61
  • 8
  • 2
    `$query = mysqli_query("SELECT...` for one thing won't fire. – Funk Forty Niner May 30 '17 at 17:43
  • 1
    **Never store plain text passwords!** PHP provides [`password_hash()`](https://php.net/manual/en/function.password-hash.php) and [`password_verify()`](https://php.net/manual/en/function.password-verify.php) please use them. If you are using a PHP version prior to 5.5 [there is a compatibility pack available here](https://github.com/ircmaxell/password_compat). Make sure you [**don't escape passwords**](https://stackoverflow.com/q/36628418/5914775) or use any other cleansing mechanism on them before hashing. Doing so changes the password and causes unnecessary additional coding. – Tom Udding May 30 '17 at 17:44
  • Your script is at risk of [**SQL Injection Attack**](https://stackoverflow.com/q/60174/5914775). Have a look at what happened to [Little Bobby Tables](http://bobby-tables.com/). Even [if you are escaping inputs, its not safe!](https://stackoverflow.com/q/5741187/5914775). Use [prepared parameterized statements](https://php.net/manual/en/mysqli.quickstart.prepared-statements.php) instead. – Tom Udding May 30 '17 at 17:47
  • You've got some spacing problems `id = "nome"name="nome"` which will break the code. Should be `id ="nome" name="nome"` Those spacing issues are on several lines. – Jay Blanchard May 30 '17 at 17:50
  • Thanks for the safety advices, but right now I am just learning and really need the help for why the POST is not working. – Bruno May 30 '17 at 17:50
  • If you don't have time to do it right the first time, when will you find the time to add it later? I hate when people say *"I'm not that far along..."* or *"This site will not be public..."* or *"It's only for school, so security doesn't matter..."*. If teachers and professors are not talking about security from day one, they're doing it wrong. Challenge them. They're teaching sloppy and dangerous coding practices which students will have to unlearn later. I also hate it when folks say, *"I'll add security later..."* or *"Security isn't important now..."* or *"Ignore the security risk..."*. – Jay Blanchard May 30 '17 at 17:51
  • 1
    `var_dump($_REQUEST);` and `var_dump($_POST);` might give you a hint as to what's going on. – aynber May 30 '17 at 17:51
  • I fixed the spacing, but it steel won't work. – Bruno May 30 '17 at 17:53
  • I used the var_dump($_REQUEST); and var_dump($_POST); and it seems that both are getting the information that I insert in the form. – Bruno May 30 '17 at 18:01

1 Answers1

0

As said by all your php script is totally vulnerable for all type of attack's. Please use Php PDO & don't avoid coding security. Regarding your issue:

Change this

<button type='submit' ></button>

To

 <input type='submit' value='submit' />

Ensure that all these inside form tag. Button are preferred when some java script is used but in your code I am not seeing any java script so avoid it. Hope it help.

CoderSam
  • 179
  • 1
  • 5
  • Are you using java script or any validation in your form? – CoderSam May 30 '17 at 18:12
  • No, should I be using? – Bruno May 30 '17 at 18:16
  • In you form change password name=pass, email name=email_n . Change same in the php script and see the result. – CoderSam May 30 '17 at 18:25
  • In you form change password name=pass, email name=email_n . Change same in the php script and see the result. – CoderSam May 30 '17 at 18:26
  • In your php.in file also check post_max_size is defined to which value. It's should be like 8M (take care of the M). – CoderSam May 30 '17 at 18:35
  • Glad that your issue resolved. Also clearly specify whoch option you have used that clears your issue so that other forum members could able to take guide and I will include that in answer. Good luck. – CoderSam May 31 '17 at 01:17