Something's wrong with my PHP register codes

Question

I've been trying to create a register page using php and html and once I was finally done and wanted to check if it works, it just reloaded the page and when I checked the database nothing new was in there. Here are the codes, in register.php,

?php

require_once('connect.php');

$errors = array();

if (isset($_GET['submit'])) {

if (empty($_POST['username'])) { array_push($errors, 'Choose a username.'); }
if (empty($_POST['email'])) { array_push($errors, 'Choose an email.'); }
if (empty($_POST['password'])) { array_push($errors, 'Choose a password.'); }

$old_usn = mysql_query("SELECT id FROM users WHERE name = '".$_POST['username']."' LIMIT 1;") or die(mysql_error());
if (mysql_num_rows($old_usn) > 0) { array_push($errors, 'This username is already taken.'); }

$old_email = mysql_query("SELECT id FROM users WHERE email = '".$_POST['email']."' LIMIT 1;") or die(mysql_error());
if (mysql_num_rows($old_email) > 0) { array_push($errors, 'There is an existing account with this email.'); }

if ($_POST['password1'] != $_POST['password2']) { array_push($errors, 'The password does not match'); }

if (sizeof($errors) == 0) {

//htmlentities($_POST['username'], ENT_QUOTES);
    $username = htmlentities($_POST['username'], ENT_QUOTES);
    $email = htmlentities($_POST['email'], ENT_QUOTES);
    $password1 = htmlentities(sha1($_POST['password1']), ENT_QUOTES);

    mysql_query("INSERT into users (name, hashed_psw, email, joined)
    VALUES ('{$username}', '{$password}', '{$email}', NOW());") or die(mysql_error());

    }

}



?>

and below that:

 <div class="container v-align-transform">
                <div class="row">
                    <div class="col-sm-6 col-sm-offset-3">
                        <div class="feature bordered text-center">
                            <h4 class="uppercase">Register Here</h4>
                            <?php

                            foreach($errors as $e) {

                                echo $e;
                                echo "<br />\n";

                                }
                            ?>
                            <form class="text-left" action="register.php" method="post">
                                <input type="text" name="username" value="" placeholder="Username" />
                                <input type="text" name="email" value="" placeholder="Email Address" />
                                <input type="password" name="password1" value="" placeholder="Password" />
                                <input type="password" name="password2" value="" placeholder="Confirm Password" />
                                <input type="submit" name="submit" value="Register" />
                            </form>
                            <p class="mb0">By signing up, you agree to our
                                <a href="/">Terms Of Use</a>
                            </p>
                        </div>
                    </div>
                </div>
            </div>

I've tried finding what's wrong but couldn't find anything.

One obvious error `if (isset($_GET['submit']))` and you're using a POST method. Edit: and another `$_POST['username']` there is no input of that name. — Funk Forty Niner, Dec 01 '16 at 19:23
[Don't use the mysql functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php). — mister martin, Dec 01 '16 at 19:23
Possible duplicate of [PHP: “Notice: Undefined variable” and “Notice: Undefined index”](http://stackoverflow.com/questions/4261133/php-notice-undefined-variable-and-notice-undefined-index) — Funk Forty Niner, Dec 01 '16 at 19:24
[ViewME](https://paragonie.com/files/blog/xkcd-327.png) Avoid mixing GET and POST in a single handler. Use mysqli or pdo with prepared statements. Look at a good tutorial with annotated code ex. [A TUT](https://www.binpress.com/tutorial/using-php-with-mysql-the-right-way/17) More in order of a warning to avoid extreme danger than a suggestion, depending on what kind of data we're talking about here. Make sure you're communicating over a secure connection if you have a separate db server as well. In other words, chuck this mess and adopt good secure database fundamentals before risking attack. — Sinthia V, Dec 01 '16 at 20:31

score 1 · Accepted Answer · answered Dec 01 '16 at 19:24

There's a few things wrong with this that you should consider buttoning up.

Don't use mysql_* functions. Use PDO, or at the very least, mysqli_* functions.
Sanitize your SQL data. Or else.
No need to use array_push (you can use it if you want to), you can use the shorthand version: $errors[] = "New Error"
Don't use sha1/md5/etc hashes for passwords. Use salted hashes instead.
Your form method is POST, but you're checking for $_GET... Switch that to $_POST (including your posted variables)

Something's wrong with my PHP register codes

1 Answers1