0

I have a problem with registration using PHP. All were ok, but when I want to create security for my website then registration doesn't work... I really don't understand why my code doesn't work.

Here is connection:

 <?php
    session_start();
    include 'config.php';

    $db = new PDO(
        "mysql:host=" .dbserver. ";dbname=" .dbname,dbuser,dbpass,
        array(
            PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES utf8",
            PDO::MYSQL_ATTR_INIT_COMMAND => "SET CHARACTER SET utf8"
        )
    );
        $ip = $_SERVER['REMOTE_ADDR'];
?>

    <form action='' method='post'>
    <table>
        <tr><td>Jméno: </td><td><input type='text' name='username' required/></td></tr>
        <tr><td>Heslo: </td><td><input type='password' name='password' required/></td></tr>
        <tr><td>Heslo znovu: </td><td><input type='password' name='passwordrepeat' required/></td></tr>
        <tr><td>Email: </td><td><input type='email' name='email' required/></td></tr>
        <tr><td><input type='submit' name='registrovat' value='Registrovat' required/></td><td></td></tr>
    </table>
</form>

    <?php

    if (isset($_POST['registrovat']))
    {
        $username = $_POST['username'];
        $password = $_POST['password'];
        $passwordre = $_POST['passwordrepeat'];
        $email = $_POST['email'];

        if ($password == $passwordre)
        {
            if ($username && $email)
            {
                $select = $db->prepare("SELECT * FROM `users` WHERE username=':username'");
                $result->execute(array(":username" => $username));
                $result = $select->fetchAll();

                foreach ($result as $data) 
                {       
                    if ($data['username'] == $username)
                    {
                        echo "<p style='color: red;'>Uživatel již existuje!</p>";
                        break;
                    } else {

                        $password = md5(sha1($password));

                        $register = "INSERT INTO users (id, username, password, ip, email, color, isadmin) VALUES ('', ':username', ':password', '$ip', ':email', '#000000', '0')";
                        $re = $db->prepare($register);
                        $re->execute(array(':username' => $username, ':password' => $password, ':email' => $email));
                        echo "Registrace proběhla úspěšně.";
                        $_SESSION['username'] = $username;
                        header('Location: JakubStanek.php');
                    }
                }
            }   
        } else {
            echo "Hesla se neshodují!";
        }
    }

?>

error

Notice: Undefined variable: result in /var/www/html/staneja14/db/index.php on line 40 Fatal error: Call to a member function execute() on a non-object in /var/www/html/staneja14/db/index.php on line 40

Jay Blanchard
  • 34,243
  • 16
  • 77
  • 119
Mebecek
  • 9
  • 1
  • Add error reporting to the top of your file(s) right after your opening ` – Jay Blanchard May 07 '15 at 14:05
  • 1
    What is the error message? – Loko May 07 '15 at 14:05
  • add explanations please, what do you mean by 'security' – xNeyte May 07 '15 at 14:06
  • remove the quotes around your placeholders -> `WHERE username=':username'` should be `WHERE username=:username`, and `VALUES ('', ':username', ':password', '$ip', ':email',` should be `VALUES ('', :username, :password, '$ip', :email,`. Also, you should use a placeholder for `$ip` as well instead on injecting it directly – Sean May 07 '15 at 14:08
  • i dont want someone drop my dabase or select my data from db – Mebecek May 07 '15 at 14:09
  • add `$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);` right after the connection is opened. You'll see the obvious syntax errors you're making. – Funk Forty Niner May 07 '15 at 14:11
  • `$result->execute(array(":username" => $username));` should be `$select->execute(array(":username" => $username));` – Sean May 07 '15 at 14:12
  • @Sean those comments of yours, are more fit as an answer, rather than comments ;-) – Funk Forty Niner May 07 '15 at 14:12
  • 1
    Note to OP: If you're going to use modern-day db code, use a modern-day hashing method. – Funk Forty Niner May 07 '15 at 14:15
  • Sean i rework this and now if i set submit button nothing do... no error message no result.. but still without error – Mebecek May 07 '15 at 14:17
  • 1
    @Fred-ii- there has been a boom of down-voters lately if you don't catch ALL of the OPs errors, so although my comments may be possible answers I don't feel like defending my answers when I only have answers to part of the issue. Also, there has been a rash of new posters, who after we point out the issues, say that it is not their actual code. I prefer right now to use the comments to help them flush out the full issue/issues before providing an answer. – Sean May 07 '15 at 14:23
  • 1
    @Sean Yeah, wise move. I thought of that after; too many things wrong with this. OP has enough to go on to fix their code. However, there was an "answer" given below. Good luck to them ;-) *Cheers Sean*. – Funk Forty Niner May 07 '15 at 14:25
  • [No errors, eh? did you do this?](http://stackoverflow.com/questions/30103449/php-registration#comment48318444_30103449). Start by doing that and learn to debug your code. – Funk Forty Niner May 07 '15 at 14:41

0 Answers0