PHP Ignoring if/Else statement in registration script - php

Question

I'm currently working on the login system on my site. Each user recieves a unique key on purchase that they then use to register on the site. Upon registration with the key it gets passed through a script that checks my database of keys to make sure it isn't in use already (if it passes that check, the key is marked "in use"). It then moves on to insert the user in the database, storing their key as well as their payment status as "sub".
My issue is that my script is completely ignoring the key check if/else block. It fails to change the in_use to "Y". It is also telling me registration successful even though the pay_status variable is not being passed to the final insert statement.
Was wondering if anyone could have a go at my php and see if there is anything obvious I am missing. Ignore the injectable points as I stripped the code down to get it functioning before I secure it again.
Heres the php:
<?php
include_once 'link_auth.php';
include_once 'link_global.php';
$error_msg = "";
if (isset($_POST['username'], $_POST['email'], $_POST['p'], $_POST['firstname'], $_POST['lastname'], $_POST['regkey'])) {
// Sanitize and validate the data passed in
$username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING);
$firstname = filter_input(INPUT_POST, 'firstname', FILTER_SANITIZE_STRING);
$lastname = filter_input(INPUT_POST, 'lastname', FILTER_SANITIZE_STRING);
$email = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL);
$email = filter_var($email, FILTER_VALIDATE_EMAIL);
$regkey = $_POST['regkey'];
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
// Not a valid email
$error_msg .= '<p class="error">The email address you entered is not valid</p>';
}
$password = filter_input(INPUT_POST, 'p', FILTER_SANITIZE_STRING);
if (strlen($password) != 128) {
// The hashed pwd should be 128 characters long.
// If it's not, something really odd has happened
$error_msg .= '<p class="error">Invalid password configuration.</p>';
}
// Username validity and password validity have been checked client side.
// This should should be adequate as nobody gains any advantage from
// breaking these rules.
//
//Check if the registration key is in use --> If so, close statement, if not, mark key as in_use = Y and add it to the user's account, set payment status from trial (if trial) to sub
$prep_stmt = "SELECT id, regkey, in_use FROM keylist WHERE regkey = '$regkey' LIMIT 1";
$stmt = $mysqli->prepare($prep_stmt);
if ($stmt) {
$stmt->execute();
$keystatus = $stmt->fetch();
if ($keystatus['in_use'] == 'N') {
//The key is available
$sql_updatekey = "UPDATE `keylist` SET in_use = 'Y' WHERE `regkey` = '$regkey'";
$pay_status = "sub";
$mysqli->query($sql_updatekey);
$stmt->close();
}
$stmt->close();
} else {
$error_msg .= '<p class="error">This key is already in use. If you feel this is an error, please contact support#hospitaldatasolutions.com</p>';
$stmt->close();
}
$prep_stmt = "SELECT id FROM members WHERE email = ? LIMIT 1";
$stmt = $mysqli->prepare($prep_stmt);
// check existing email
if ($stmt) {
$stmt->bind_param('s', $email);
$stmt->execute();
$stmt->store_result();
if ($stmt->num_rows == 1) {
// A user with this email address already exists
$error_msg .= '<p class="error">A user with this email address already exists.</p>';
$stmt->close();
}
$stmt->close();
} else {
$error_msg .= '<p class="error">Database error Line 39</p>';
$stmt->close();
}
// check existing username
$prep_stmt = "SELECT id FROM members WHERE username = ? LIMIT 1";
$stmt = $mysqli->prepare($prep_stmt);
if ($stmt) {
$stmt->bind_param('s', $username);
$stmt->execute();
$stmt->store_result();
if ($stmt->num_rows == 1) {
// A user with this username already exists
$error_msg .= '<p class="error">A user with this username already exists</p>';
$stmt->close();
}
$stmt->close();
} else {
$error_msg .= '<p class="error">Database error line 55</p>';
$stmt->close();
}
// TODO:
// We'll also have to account for the situation where the user doesn't have
// rights to do registration, by checking what type of user is attempting to
// perform the operation.
if (empty($error_msg)) {
// Create a random salt
//$random_salt = hash('sha512', uniqid(openssl_random_pseudo_bytes(16), TRUE)); // Did not work
$random_salt = hash('sha512', uniqid(mt_rand(1, mt_getrandmax()), true));
// Create salted password
$password = hash('sha512', $password . $random_salt);
// Insert the new user into the database
if ($insert_stmt = $mysqli->prepare("INSERT INTO members (username, email, password, firstname, lastname, regkey, salt, payment_status) VALUES (?, ?, ?, ?, ?, ?, ?, ?)")) {
$insert_stmt->bind_param('ssssssss', $username, $email, $password, $firstname, $lastname, $regkey, $random_salt, $pay_status);
// Execute the prepared query.
if (! $insert_stmt->execute()) {
header('Location: ../error.php?err=Registration failure: INSERT');
}
}
header('Location: register_success.php');
}
}
EDIT: Here is the correct result:
//Check if the registration key is in use --> If so, close statement, if not, mark key as in_use = Y and add it to the user's account, set payment status from trial (if trial) to sub
$prep_stmt = "SELECT regkey, active FROM keylist WHERE regkey = '$regkey' LIMIT 1";
$stmt = $mysqli->prepare($prep_stmt);
if ($stmt) {
$stmt->execute();
$stmt->store_result();
$stmt->bind_result($col2,$col3);
$keystatus = $stmt->fetch();
var_dump($col2,$col3);
if ($keystatus && $col3=='N') {
//The key is available
$sql_updatekey = "UPDATE `keylist` SET active = 'Y' WHERE `regkey` = '$col2'";
$res=$mysqli->query($sql_updatekey);
$stmt->close();
}
else {
$error_msg .= '<p class="error">This key is already in use. If you feel this is an error, please contact support#hospitaldatasolutions.com</p>';
$stmt->close();
}
}
The store_result() method is key as it frees up $mysqli to perform a new query. If there are still results waiting from the previous query, it will fail to perform the next. As of now my problem is completely solved. Both tables update with the necessary information.

Answer 1

There is logical error in if else part, I think els block for "key already used" is misplaced with if($stmt). I assume your Keylist has in_use = 'N' for not used keys.
<?php
include_once 'link_auth.php';
include_once 'link_global.php';
$error_msg = "";
if (isset($_POST['username'], $_POST['email'], $_POST['p'], $_POST['firstname'], $_POST['lastname'], $_POST['regkey'])) {
// Sanitize and validate the data passed in
$username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING);
$firstname = filter_input(INPUT_POST, 'firstname', FILTER_SANITIZE_STRING);
$lastname = filter_input(INPUT_POST, 'lastname', FILTER_SANITIZE_STRING);
$email = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL);
$email = filter_var($email, FILTER_VALIDATE_EMAIL);
$regkey = $_POST['regkey'];
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
// Not a valid email
$error_msg .= '<p class="error">The email address you entered is not valid</p>';
}
$password = filter_input(INPUT_POST, 'p', FILTER_SANITIZE_STRING);
if (strlen($password) != 128) {
// The hashed pwd should be 128 characters long.
// If it's not, something really odd has happened
$error_msg .= '<p class="error">Invalid password configuration.</p>';
}
// Username validity and password validity have been checked client side.
// This should should be adequate as nobody gains any advantage from
// breaking these rules.
//
//Check if the registration key is in use --> If so, close statement, if not, mark key as in_use = Y and add it to the user's account, set payment status from trial (if trial) to sub
$prep_stmt = "SELECT id, regkey, in_use FROM keylist WHERE regkey = '$regkey' LIMIT 1";
$stmt = $mysqli->prepare($prep_stmt);
if ($stmt) {
$stmt->execute();
$stmt->bind_result($col1, $col2,$col3);
$keystatus = $stmt->fetch();
if ($keystatus && $col3=="N") {
//The key is available
$sql_updatekey = "UPDATE `keylist` SET in_use = 'Y' WHERE `regkey` = '$regkey'";
$pay_status = "sub";
$mysqli->query($sql_updatekey);
$stmt->close();
}
else {
$error_msg .= '<p class="error">This key is already in use. If you feel this is an error, please contact support#hospitaldatasolutions.com</p>';
$stmt->close();
}
}
$prep_stmt = "SELECT id FROM members WHERE email = ? LIMIT 1";
$stmt = $mysqli->prepare($prep_stmt);
// check existing email
if ($stmt) {
$stmt->bind_param('s', $email);
$stmt->execute();
$stmt->store_result();
if ($stmt->num_rows == 1) {
// A user with this email address already exists
$error_msg .= '<p class="error">A user with this email address already exists.</p>';
$stmt->close();
}
$stmt->close();
} else {
$error_msg .= '<p class="error">Database error Line 39</p>';
$stmt->close();
}
// check existing username
$prep_stmt = "SELECT id FROM members WHERE username = ? LIMIT 1";
$stmt = $mysqli->prepare($prep_stmt);
if ($stmt) {
$stmt->bind_param('s', $username);
$stmt->execute();
$stmt->store_result();
if ($stmt->num_rows == 1) {
// A user with this username already exists
$error_msg .= '<p class="error">A user with this username already exists</p>';
$stmt->close();
}
$stmt->close();
} else {
$error_msg .= '<p class="error">Database error line 55</p>';
$stmt->close();
}
// TODO:
// We'll also have to account for the situation where the user doesn't have
// rights to do registration, by checking what type of user is attempting to
// perform the operation.
if (empty($error_msg)) {
// Create a random salt
//$random_salt = hash('sha512', uniqid(openssl_random_pseudo_bytes(16), TRUE)); // Did not work
$random_salt = hash('sha512', uniqid(mt_rand(1, mt_getrandmax()), true));
// Create salted password
$password = hash('sha512', $password . $random_salt);
// Insert the new user into the database
if ($insert_stmt = $mysqli->prepare("INSERT INTO members (username, email, password, firstname, lastname, regkey, salt, payment_status) VALUES (?, ?, ?, ?, ?, ?, ?, ?)")) {
$insert_stmt->bind_param('ssssssss', $username, $email, $password, $firstname, $lastname, $regkey, $random_salt, $pay_status);
// Execute the prepared query.
if (! $insert_stmt->execute()) {
header('Location: ../error.php?err=Registration failure: INSERT');
}
}
header('Location: register_success.php');
}
}