PHP Mysql Forum User Creation Script doesn't work [closed] - php

Question

Closed. This question needs debugging details. It is not currently accepting answers.
Edit the question to include desired behavior, a specific problem or error, and the shortest code necessary to reproduce the problem. This will help others answer the question.
Closed 7 years ago.
Improve this question
My code doesn't work, nor it gives me any errors, so the code is right, but still doesn't work.
The code aims to look up for the entered data of a HTML form and, if the entered values are not stored on the database, creating them(the new user).
<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);
define('SECURE', true);
require_once('_connecting.php');
include "_head.php";
if(isset($_POST["send"]))
{
$username = $_POST["user_name"];
$mail=$_POST["user_email"];
$passwort = $_POST["user_password"];
$passwort2 = $_POST["user_password2"];
if(strlen($passwort)<6||$passwort!=$passwort2)
{
echo "Eingabefehler. Bitte alle Felder korekt ausfüllen. Zurück";
}
else
{
$check = ("SELECT Count(*) FROM user WHERE user_email ='$mail'");
$mysqli->query($check);
if ($check > 1) {
echo "Schon vorhanden";
exit();
} else {
$send="INSERT INTO user (user_name, user_email,user_password) VALUES ('$username','$passwort','$mail')";
$mysqli->query($send);
}
}}
?>
<h1>
Registriere dich jetzt, um alle Funktionen des Forums in vollem Umfang genießen zu können.
</h1>
<h1 id="yellowh1">
Du wirst es nicht bereuen - Es warten viele spannende Dinge auf dich.
</h1>
<form action="signup.php" method="post">
<br><br>
<input type="text" name="user_name" value="" required="required" placeholder="Nutzername" maxlength="255" />
<br>
<br>
<input type="email" name="user_email" value="<?php echo !empty($_POST['user_email']) ? $_POST['user_email'] : ''; ?>" required="required" placeholder="E-Mail-Adresse" maxlength="255" />
<br><br>
<input type="password" name="user_password" required="required" placeholder="Passwort" maxlength="50" />
<input type="password" name="user_password2" required="required" placeholder="Passwort erneut eingeben" maxlength="50" />
<br><br>
<input type="submit" value="Abschicken" name="send">
</form>
<?php include "_footer.php";?>

Answer 1

There are a few problems here.
$mail=$_POSST["user_email"];
Firstly, there is a typo in there and you must remove one of the S's. It's a superglobal.
Having error reporting would have signaled:
Notice: Undefined variable: _POSST in...
As I stated in comments, your query depends on it. WHERE user_email ='$mail' and you're not checking for errors anywhere.
VALUES ('$username','$passwort','$mail') that will also fail because of the typo in $_POSST.
Then you have value="<?php echo $user_email; ?>" for the name="user_email" input, which will also throw the following notice in the input field itself, as soon as you hit the submit button:
Notice: Undefined variable: user_email in...
Therefore, you need to use a ternary operator:
value="<?php echo !empty($_POST['user_email']) ? $_POST['user_email'] : ''; ?>"
Add error reporting to the top of your file(s) which will help find errors.
<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);
// rest of your code
Sidenote: Error reporting should only be done in staging, and never production.
Footnotes:
Your present code is open to SQL injection. Use prepared statements, or PDO with prepared statements, they're much safer.
I noticed you may be storing passwords in plain text. If this is the case, it is highly discouraged.
I recommend you use CRYPT_BLOWFISH or PHP 5.5's password_hash() function. For PHP < 5.5 use the password_hash() compatibility pack.
References:
http://php.net/manual/en/language.operators.comparison.php
http://php.net/manual/en/function.error-reporting.php
http://php.net/manual/en/language.variables.superglobals.php
http://php.net/manual/en/mysqli.error.php
Final notes:
Since the MySQL API to connect with is unknown (to me), make sure that you are in fact using mysqli_ to connect with, and not another one that is different. Different MySQL APIs do not intermix with each other.
Use the same API from connection to query.
https://php.net/mysqlinfo.api.choosing
As stated in comments and kudos to "Don't Panic":
$mysqli->query->execute seems kind of strange. – Don't Panic
This method of querying $mysqli->query->execute(...) is used for prepared statements. http://php.net/manual/en/mysqli.prepare.php
Those need to be modified as just $mysqli->query(...)
As per the manual http://php.net/manual/en/mysqli.query.php