OTP integration at registration form - php

Question

I am having trouble integrating the "send OTP" function in my registration form. I was given an API from an SMS provider, but I do not know how to integrate it into my form. I need the user data to be recorded in my database after the verify the OTP. But how the verify process work? and how does the system would generate 6 digits random code to the user? I have been trying a different method and search online but none of that is working. Can anyone help?
Here is my form:
<div class="modal-body">
<form action="includes/signup.inc.php" method="POST" class="p-3">
<div class="form-group">
<label for="recipient-name" class="col-form-label">First Name</label>
<input type="text" class="form-control" placeholder="First Name" name="first" required="">
</div>
<div class="form-group">
<label for="recipient-name" class="col-form-label">Last Name</label>
<input type="text" class="form-control" placeholder="Last Name" name="last" required="">
</div>
<div class="form-group">
<label for="recipient-name" class="col-form-label">Username</label>
<input type="text" class="form-control" placeholder="Username" name="uid" required="" >
</div>
<div class="form-group">
<label for="recipient-name1" class="col-form-label">Date of Birth</label>
<input type="date" class="form-control" placeholder="dob" name="dob" required="">
</div>
<div class="form-group">
<label for="recipient-name" class="col-form-label">Email Address</label>
<input type="email" class="form-control" placeholder="Email" name="email" required="" >
</div>
<div class="form-group">
<label for="recipient-name" class="col-form-label">Password</label>
<input type="password" class="form-control" placeholder="Password" name="pass" required="">
</div>
<div class="form-group">
<label for="recipient-name" class="col-form-label">Confirm Password</label>
<input type="password" class="form-control" placeholder="Confirm Password" name="c_pass" required="">
</div>
<div class="form-group">
<label for="recipient-name" class="col-form-label">Are You Previously an Existing Member?</label>
<select class="form-control" id="recipient-name10" name="member">
<option>Yes</option>
<option>No</option>
</select>
</div>
<div class="form-group">
<label for="recipient-name" class="col-form-label">Where do you know about this membership?</label>
<select class="form-control" id="recipient-name11" name="outlet">
<option>The Metallic Kitchen # Golden Triangle Pelangi, JB</option>
<option>The Metallic Kitchen # Taman Mount Austin, JB</option>
<option>The Metallic Kitchen & Bar # Setapak Village, KL</option>
<option>None of the above</option>
</select>
</div>
<div class="form-group">
<label for="recipient-name" class="col-form-label">OTP</label>
<input type="text" class="form-control" placeholder="OTP" name="otp" required="">
</div>
<div class="right-w3l mt-4 mb-3">
<input type="submit" class="form-control" value="Create account" name="submit">
</div>
</form>
</div>
and here is my sms provider API:
<?php
function sendSmsToEsms() {
$url = 'https://api.esms.com.my/sms/send';
// replace yourusername, yourpassword, and 60123456789 to suits your need
$data = array('user' => 'yourusername',
'pass' => 'yourpassword',
'to' => '60123456789',
'msg' => 'RM0.00 Hello from ESMS');
$options = array(
'http' => array(
'header' => "Content-type: application/x-www-form-urlencoded; charset=utf-8",
'method' => 'POST',
'content' => http_build_query($data)
)
);
$context = stream_context_create($options);
$result = file_get_contents($url, false, $context);
if ($result === FALSE) { /* Handle error */ }
var_dump($result);
}
?>
here is my code for adding data into database:
<?php
if (isset($_POST['submit'])){
include_once 'db.php';
$first = mysqli_real_escape_string($conn,$_POST['first']);
$last = mysqli_real_escape_string($conn,$_POST['last']);
$uid = mysqli_real_escape_string($conn,$_POST['uid']);
$dob = mysqli_real_escape_string($conn,$_POST['dob']);
$email = mysqli_real_escape_string($conn,$_POST['email']);
$mobile = mysqli_real_escape_string($conn, $_POST['m_number']);
$pwd = mysqli_real_escape_string($conn,$_POST['pass']);
$member =mysqli_real_escape_string($conn, $_POST['member']);
$outlet = mysqli_real_escape_string($conn,$_POST['outlet']);
//ERROR HANDLERS
//CHECK FOR EMPTY FIELDS
//if(empty($first)||empty($last)||empty($uid)||empty($dob)||empty($email)||empty($mobile)||empty($pwd)||empty($member)||empty($outlet))
//{
//header("Location:../index.php?signup=empty");
//exit();
//}else{
//check if input characters are valid
//if(!preg_match("/^[a-zA-Z]*$/", $first)|| !preg_match("/^[a-zA-Z]*$/", $last)){
//header("Location:../signup.php?signup=invalid");
//exit();
//}else{
//check email
if(!filter_var($email,FILTER_VALIDATE_EMAIL)){
echo "<script>alert('Invalid Email,please register again.')</script>";
echo "<script>window.open('../index.php','_self')</script>";
exit();
}else{
//check if username is same
$sql = "SELECT * FROM users WHERE user_uid = '$uid'";
$result = mysqli_query ($conn,$sql);
$resultCheck = mysqli_num_rows ($result);
if ($resultCheck > 0) {
echo "<script>alert('Username has been taken, please register again.')</script>";
echo "<script>window.open('../index.php','_self')</script>";
exit();
}else{
//Hashing pwd
$hashedPwd = password_hash($pwd,PASSWORD_DEFAULT);
//INSERT THE USER INTO THE DATABASE
$sql = "INSERT INTO users (user_first,user_last,user_uid,user_dob,user_email,user_mobile,user_pwd,user_member,user_outlet) VALUES ('$first','$last','$uid','$dob','$email','$mobile','$hashedPwd','$member','$outlet');";
mysqli_query($conn,$sql);
echo "<script>alert('You have been Registered Successfully, Please login from our main page')</script>";
echo "<script>window.open('../index.php','_self')</script>";
exit();
}
}
}
else{
header("Location:../index.php");
exit();
}
?>

Answer 1

You should temporarily save user data into database as well as the generated OTP and also an extra column to indicate if user is validated. (I suggest to hash OTP before saving).
Later when the user tries the username and OTP for login, you should check entered data against the database. If user and OTP are correct, check that column to validate the registration. If OTP is incorrect you can leave that column for more tries (or delete user account or void the OTP or regenerate a new OTP bases on your opinion).
to generate a random number use mt_rand algorythm:
$password=mt_rand (10,100);
and use it in API as follow:
'pass' => $password,