Making a multi functions file - php

Question

Ok, I'm in the middle of making a multi function php file.
The file is named functions.php and has switch - case.
At first, I just have a simple register.php file which sends to functions.php.
Here's the error which I get :-
Notice: Undefined index: action in C:\Program Files (x86)\EasyPHP-DevServer-13.1VC9\data\localweb\transfer\functions.php on line 5
functions.php?username=223&password=223&action=register
This is pretty unsecure..I just want to show the action..like functions.php?action=register
What changes do I make to my script ?
Here's the code :-
register.php
<form action="functions.php" name="post">
<table>
<tr>
<td>Username : </td>
<td><input type="text" name="username"/></td>
</tr>
<tr>
<td>Password : </td>
<td><input type="password" name="password"/></td>
</tr>
<tr>
<td><input type="submit" name="action" value="register"></td>
</tr>
</table>
</form>
functions.php
<?php
session_start();
$db = mysql_connect('127.0.0.1', 'root', 'akshay!##') or die (mysql_error($db));
mysql_select_db('transfer', $db);
switch($_POST['action'])
{
case 'register':
$username = (isset($_POST['username'])) ? $_POST['username'] : '';
$password=(isset($_POST['password'])) ? $_POST['password'] : '';
$username=mysql_real_escape_string($username, $db);
$password = md5($password);
$password = mysql_real_escape_string($password);
$query = "select * from users where user_name = '" . $username . "'";
$result = mysql_query($query, $db) or die (mysql_error($db));
if(mysql_num_rows($result) > 0)
{
echo "Username already exists, redirecting";
header('Refresh: 3; URL=register.php');
die();
}
if(empty($username) || empty($password))
{
echo "Fields cannot be empty, redirecting";
header('Refresh: 3; URL=register.php');
}
else
{
$query2 = "insert into users(user_id, user_name, user_pass)
values
(NULL, '" . $username . "', '" . $password . "')";
$result2 = mysql_query($query2, $db) or die (mysql_error($db));
if($result2)
{
echo "Registration successful";
}
else
{
echo "Cannot register";
}
}
break;
}
?>

Answer 1

Based on the query string ("functions.php?username=223&password=223&action=register"), it looks like you're using GET to send the data, and not POST.
You should be looking for $_GET['action'] instead, and you should use
isset($_GET['action'])
to check if the action is set.
Edit
If you're set on using POST, which you really should be for this type of application, then you'll need to change your form:
<form action="functions.php" name="post" method="post">
Additionally, you'll want to use a hidden field for the action parameter instead of using the submit button:
<td>
<input type="hidden" name="action" value="register" />
<input type="submit" name="submit" value="Submit" />
</td>
The method="POST" attribute ensures that your data will be transmitted to functions.php using POST. This way the data won't show up in the URL.
Then, your functions.php can contain:
if (isset($_POST['action'])) {
switch($_POST['action']) {
case 'register':
$username = (isset($_POST['username'])) ? $_POST['username'] : '';
// And so on
}
}
else {
echo "No action specified.";
}

Answer 2

It means that $_POST['action'] isn't set.
In your example you pass it in the URL, so should be using $_GET['action'] instead.