Database slice the last two characters of the password (?!) - php

Question

I have a very frustrating problem. I have a client which send a registration form to the server. The handler is a php file.
The problem is the following: the client send the form data to the php, the php store it in the mysql database. But if I try to give a name which is contains a space - I don't know why - in the database the the password's length is reduced by two.
I searched long hours, but found nothing. I'm on the edge of madness, so I would like to ask you to help me to find the problem.
Here is the registration form:
<!-- REGISTRATION -->
<div data-role="page" id="regScreen">
<div data-role="content">
<div class="profileCircle">
<img src="img/iskola.jpg" />
</div>
<div class="space"></div>
<form action="" method="post" id="regForm" name="regForm">
<input type="text" name="nev" id="regName" placeholder="Teljes név" data-mini="true"/>
<input type="email" name="mail" id="regEmail" placeholder="Email cím" data-mini="true"/>
<input type="password" name="jelszo" id="regPassword" placeholder="Jelszó" data-mini="true"/>
<input type="submit" data-inline="true" data-mini="true" value="Regisztráció" name="rendben" id="rendben" />
</form>
</div>
<a href="#loginScreen"><div class="circle leftBottom c1">
<img src="img/ikonok/vissza.png" />
</div></a>
</div>
This is the script which should handle the registration on the client side:
function registration(){
var name = $('#regForm #regName').val();
var email = $('#regForm #regEmail').val();
var password = $('#regForm #regPassword').val();
if((password == "" || password == null) || (email == "" || email == null)){
navigator.notification.alert("Nem töltött ki minden adatot!", function(){}, "Figyelem!");
}else{
$.ajax({
url: host + "regisztracio.php",
type: 'post',
dataType: 'json',
data: {rendben:'ok', nev: name, mail: email, jelszo: password},
success: function(data){
if(data.ok){
navigator.notification.alert('Sikeresen regisztrált!\nMostmár be tud jelentkezni a saját felhasználónevével!',function(){
$.mobile.changePage("#loginScreen");
},'Üdvözöljük!');
}else{
navigator.notification.alert(data.uzenet,function(){},'Figyelem!');
if(data.help){
navigator.notification.confirm('Kívánja, hogy új jelszót küldjünk erre az email címre?',function(){
console.log(button);
}, 'Segíthetünk?', 'Igen, Nem');
}
}
},
error: function(err){
console.log('jajj');
navigator.notification.alert(err.message,function(){},'Hiba!');
}
});
}
}
And finally here is the php code:
<?php
if (isset($_POST['rendben'])) {
require("mysql.php");
$nev = $_POST['nev'];
$mail = $_POST['mail'];
$jelszo = $_POST['jelszo'];
if (empty($_POST['nev']) OR empty($_POST['mail']) OR empty($_POST['jelszo'])) {
$string = array("ok" => false, "uzenet" => "Nem töltött ki minden adatot!");
echo json_encode($string);
}else{
$sql = "SELECT *
FROM felhasznalok
WHERE mail = '{$mail}'";
$eredmeny = mysql_query($sql);
if (mysql_num_rows($eredmeny) == 0) {
$sql = "INSERT INTO felhasznalok
(nev, mail, jelszo, kep)
VALUES
('{$nev}', '{$mail}', '{$jelszo}', '{$kep}')";
mysql_query($sql);
$string = array("ok" => true);
echo json_encode($string);
}else{
$string = array("ok" => false, "help" => true, "uzenet" => "Ezzel az email címmel már regisztráltak, lehet, hogy elfelejtette a jelszavát?");
echo json_encode($string);
}
}
}?>
If you need I will upload a picture from the database table.
I hope you can help me.

Answer 1

Please forgive not a full answer as such but the formatting is better than a comment:
As others have already suggested:
Echo your sql statement. This is what is being stored in the db after all. This will show you whether your problem lies before or after the data is stored in the db.
var_dump($_POST) if your sql is good as this checks the code in between the receipt of data and its storage in the DB - you can see what your script actually sends.
escape your text to prevent 'sql injection' - Always escape the text because you never know when you are going to change your client page and it is safer that way. Your case is a prime example of why you never trust data from the client.
FWIIW, I suspect that the problem lies in the javascript. One problem with the use of libraries like jquery is that they actually don't make easy stuff easier. They make it more complex. A bit like a slide rule though, once learned, they make some complicated stuff no harder than the easy stuff. There is a code-portability benefit too.
Even so, IMHO, for a simple ajax call, you're actually better off using pure JS, certainly as a beginner. w3schools.com has an excellent AJAX tutorial and code examples.
mysql_* extensions are deprecated. You would be wise to learn mysqli_ (which is nearly identical) or PDO.

Answer 2

My guess is that you are having troubles with jQuery.param encoding of spaces (+, one character, instead of %20, three characters).
You can try manually replacing the ' ' with '%20' in the password field (note: you probably have the same problem in all fields, only you haven't noticed it yet) using the .beforeSend setting:
url: host + "regisztracio.php",
type: 'post',
dataType: 'json',
data: {rendben:'ok', nev: name, mail: email, jelszo: password},
beforeSend: function (req, data) {
data.jelszo = data.jelszo.replace(/\+/g, "%20");
},
success: function(data){
...
Also (but this is unrelated), on the PHP side, notice that you can simplify a bit your code to encode the answer in one place only:
$string = array("ok" => false);
// Ez ad némi biztonságot
$fields = array('nev','mail','jelszo');
foreach($fields as $field)
{
if (empty($_POST[$field]))
$string['uzenet'] = "Nem töltött ki minden adatot: ${field}!";
else
${$field} = mysql_real_escape_string($_POST[$field]);
}
if (!isset($string['uzenet']) {
$sql = "SELECT *
FROM felhasznalok
WHERE mail = '{$mail}'";
$eredmeny = mysql_query($sql);
if (mysql_num_rows($eredmeny) == 0) {
$sql = "INSERT INTO felhasznalok
(nev, mail, jelszo, kep)
VALUES
('{$nev}', '{$mail}', '{$jelszo}', '{$kep}')";
if (false === mysql_query($sql))
$string['uzenet'] = 'Volt egy adatbázis hiba!';
else
$string['ok'] = true;
}else{
$string['help'] = true;
$string['uzenet'] = 'Ezzel az email címmel már regisztráltak, lehet, hogy elfelejtette a jelszavát?';
}
}
die(json_encode($string)); // No more output after this.