0

So i have made an website using AngularJS, PHP, mySQL. I have an registration form where I try to use polish characters. This is my html parts where i set everything to UTF-8

<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />

My HTML form :

<div class="modal fade" id="registerModal">
    <div class="modal-dialog">
      <div class="modal-content" ng-controller="registerController">
        <div class="modal-header"><h4 class="modal-title">Sign Up</h4></br><button type="button" class="close" data-dismiss="modal">&times;</button></div>
        <div class="modal-body"><form name="registerForm">
            <div class="row">
                <div class="col-lg-6">
                  <label style="float: left;"><b>Firstname:</b></label>
                  <input type="text" ng-model="registerData.firstname" class="form-control"></br>
                  <label style="float: left;"><b>Lastname:</b></label>
                  <input type="text" ng-model="registerData.lastname" class="form-control"></br>
                  <label style="float: left;"><b><span class="redstar">*</span> Username:</b></label>
                  <input type="text" ng-model="registerData.login" class="form-control">
                  <span ng-show="registerData.login.length < 6" class="badge badge-danger">Username must be 6-45 tekens.</span></br>
                  <label style="float: left;"><b><span class="redstar">*</span> Password:</b></label>
                  <input type="password" ng-model="registerData.password" class="form-control">
                  <span ng-show="registerData.password.length < 8" class="badge badge-danger">Password must be at least 8 tekens.</span></br>
                  <label style="float: left;"><b><span class="redstar">*</span> Repeat Password:</b></label>
                  <input type="password" ng-model="repeat" class="form-control">
                  <span ng-show="repeat != registerData.password" class="badge badge-danger">Passwords aren't the same.</span></br>
                </div>
                <div class="col-lg-6">
                  <label style="float: left;"><b><span class="redstar">*</span> E-Mail:</b></label>
                  <input type="email" name="email" ng-model="registerData.email" ng-pattern="emailFormat" class="form-control">
                  <span ng-show="registerForm.email.$error.pattern" class="error badge badge-danger">This e-mail is incorrect.</span></br>
                  <label style="float: left;"><b>City:</b></label>
                  <input type="text" ng-model="registerData.city" class="form-control"></br>
                  <label style="float: left;"><b>Postal Code:</b></label>
                  <input type="text" ng-model="registerData.postalcode" class="form-control"></br>
                  <label style="float: left;"><b>Adress:</b></label>
                  <input type="text" ng-model="registerData.adress" class="form-control"></br>
                  <label style="float: left;"><b>Country:</b></label>
                  <select class="form-control" ng-model="registerData.country" required>
                    <option value='' ng-selected="null" disabled>
                      Select Country
                    </option>
                    <option ng-repeat="item in countries" value="{{item.country_id}}">
                      {{item.name}}
                    </option>
                  </select></br>
                </div>
                <div class="col-lg-12">
                  <p style="float:left;">Fields marked with <span class="redstar"><b>*</b></span> are required.</p></br>
                </div>
            </div>
        </form></div>
        <div class="modal-footer"><button type="button" class="btn btn-danger" data-dismiss="modal">Close</button><button type="button" class="btn btn-success" data-dismiss="modal" ng-click="registerFunction()">Sign Up</button></div>
        </div></div>
    </div>

My AngularJs controller :

.controller('registerController', function($scope, $http, $cookieStore) {
  $scope.emailFormat = /^[a-z]+[a-z0-9._]+@[a-z]+\.[a-z.]{2,5}$/;
  $scope.registerData = {firstname : null, lastname : null, login: null, password : null, email : null, city : null, postalcode : null, adress: null, country: null};

  $scope.registerFunction = function() {
  $http({
    method: "post",
    url: './php/registration.php',
    data: {
        firstname: $scope.registerData.firstname,
        lastname: $scope.registerData.lastname,
        login: $scope.registerData.login,
        password: $scope.registerData.password,
        email: $scope.registerData.email,
        city: $scope.registerData.city,
        postalcode: $scope.registerData.postalcode,
        adress: $scope.registerData.adress,
        country: $scope.registerData.country,
    },
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' }
    }).then(function successCallback(response) {
          $scope.registerResponse = response.data;
          if ($scope.registerResponse === 'Duplicate login entry') {
            swal ( "Oops",  "Account with this login already exists!",  "error" )
            return;
          }
          if ($scope.registerResponse === 'Duplicate e-mail entry') {
            swal ( "Oops",  "Account with this e-mail already exists!",  "error" )
            return;
          }
          if ($scope.registerResponse === 'Success') {
            swal ( "Yeah!",  "Your account has been registered!",  "success" )
            return;
          }
          else {
            swal ( "Oops",  "Something went wrong, try again!",  "error" )
            return;
          }
        })
    }})

My connection to DB :

<?php
$hostname='localhost';
$username='root';
$password='';

try {
    $dbh = new PDO("mysql:host=$hostname;dbname=myshop;",$username,$password);
    $dbh->query ('SET NAMES utf8');
    $dbh->query ('SET CHARACTER_SET utf8_unicode_ci');
    $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); // <== add this line
} catch (PDOException $e) {
      echo $e->getMessage();
    }
?>

My PHP where i insert it :

<?php
include_once 'config.php';
$data = json_decode(file_get_contents("php://input"));

$firstname = $data->firstname;
$lastname = $data->lastname;
$login = $data->login;
$password = $data->password;
$email = $data->email;
$city = $data->city;
$postalcode = $data->postalcode;
$adress = $data->adress;
$country = $data->country;


try {
  $stmt = $dbh->prepare("INSERT INTO `accounts` (`account_id`, `firstname`, `lastname`, `login`, `password`, `email`, `city`, `postalcode`, `adress`, `country`, `role`)
    VALUES (NULL,'".$firstname."','".$lastname."','".$login."',MD5('".$password."'),'".$email."','".$city."','".$postalcode."','".$adress."','".$country."', 0) ");
    $stmt->execute();
  } catch (PDOException $e) {
      if (strpos($e->getMessage(), "for key 'login'") !== false) {
          echo 'Duplicate login entry';
          exit;
      } if (strpos($e->getMessage(), "for key 'email'") !== false) {
          echo 'Duplicate e-mail entry';
          exit;
      }
      else {
          throw $e;
      }
  }
  echo 'Success';

?>

I have queried this queries in my mySQL :

ALTER DATABASE `my_database` DEFAULT CHARACTER SET utf8 COLLATE utf8_unicode_ci;
ALTER TABLE `my_table_name` DEFAULT CHARACTER SET utf8 COLLATE utf8_unicode_ci

And I still don't have polish characters in my database. I know it's for sure a duplicate of other question but i have tried everything I found, and I still don't know what am I missing in my code, is this because of JSON encode ? Please help me find it out.

SupremeDEV
  • 384
  • 1
  • 15
  • 2
    Your code is vulnerable to [**SQL injection**](https://en.wikipedia.org/wiki/SQL_injection) attacks. You should use prepared statements with bound parameters, via either [**mysqli**](https://secure.php.net/manual/en/mysqli.prepare.php) or [**PDO**](https://secure.php.net/manual/en/pdo.prepared-statements.php). [**This post**](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) has some good examples. – Alex Howansky Mar 22 '18 at 19:24
  • 2
    MD5 is considered broken for security purposes and is not sufficient for password hashing. Use [`password_hash()`](http://us3.php.net/manual/en/function.password-hash.php) and [`password_verify()`](http://us3.php.net/manual/en/function.password-verify.php) instead. If you're using a version of PHP prior to 5.5, you can use [this compatibility pack](https://github.com/ircmaxell/password_compat). – Alex Howansky Mar 22 '18 at 19:24
  • Thank you very much @AlexHowansky ! I am still learning much so i will mark your tips and use them asap ! :) – SupremeDEV Mar 22 '18 at 19:25

0 Answers0