0

I'm new to PHP and programming, but I started building my own website, which will need a registration site woth the following PHP code:

<?php
$fnameErr = $lnameErr = $emailErr = $pwErr = $pw_confErr = "";
$fname = $lname = $email = $pw = $pw_conf = "";

function test_input($data) {
  $data = trim($data);
  $data = stripslashes($data);
  $data = htmlspecialchars($data);
  return $data;
}

if ($_SERVER["REQUEST_METHOD"] == "POST") {
  if (empty($_POST["fname"])) {
    $fnameErr = "(Please submit first name)";
  } 
  else {
    $fname = test_input($_POST["fname"]);
  }

  if (empty($_POST["lname"])) {
    $lnameErr = "(Please submit last name)";
  } 
  else {
    $lname = test_input($_POST["lname"]);
  }

  if (empty($_POST["email"])) {
    $emailErr = "(Please submit email address)";
  } 
  else {
    $email = test_input($_POST["email"]);
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
      $emailErr = "(Email address is not valid)"; 
    }
  }

  include ("email_compare.php");

  if (empty($_POST["pw"])) {
    $pwErr = "(Please submit password)";
  } 
  else {
    $pw = test_input($_POST["pw"]);
    $pwHash = password_hash($pw, PASSWORD_DEFAULT);
  }

  if (empty($_POST["pw_conf"])) {
    $pw_confErr = "(Please confirm password)";
  } 
  else {
    $pw_conf = test_input($_POST["pw_conf"]);
  }

  if ($_POST["pw"] !== $_POST["pw_conf"]) {
    $pwErr = "(Please confirm password)";
    $pw_confErr = "";
  } 

  if (empty($fnameErr) && empty($lnameErr) && empty($emailErr) && empty

($pwErr) && empty($pw_confErr))
  {
    include ("db_add.php"); 
    header('Location: register_success_en.php');
    exit;
  }
}
?>

I just found out, that data, that should be included into MYSQL should be escaped by mysqli_real_escape_string, but I already use my test_input function, which, in my opinion, has the same effect.

So my question: is the test_input function sufficient or should I also use mysqli_real_escape_string?

Thanks in advance!

sebjel
  • 13
  • 7
  • Neither. You should be using prepared statements while test_input function should be thrown away – Your Common Sense Jan 29 '17 at 16:47
  • Consider the user input `hayden; DROP TABLE users;` in the first name field. `htmlspecialchars()` wouldn't escape anything there because none of those characters have special meaning in HTML. `mysqli_real_escape_string()` would be better - that used to be a common recommendation - but prepared statements is considered the best practice now. See the marked duplicate. – HPierce Jan 29 '17 at 16:51

0 Answers0