0

I have built a site which hashes passwords for new users. The site worked and the passwords hashed. Xampp crashed and I had to reinstall and I now get a syntax error when I try to register a new user. I have not changed the code, the error is:

Parse error: syntax error, unexpected ':', expecting ')' in C:\Users\chris\OneDrive\Desktop\XAMPP\htdocs\irnMind\register-process.php on line 67

Line 67 is - $hash = password_hash($pwd, algo: PASSWORD_BCRYPT);

$checkUser ="SELECT * FROM users WHERE username = '$user'";
$result = $conn->query($checkUser);

if($result->num_rows > 0){
        header('Location: register.php?error=usernametaken');
    
}else{
    $hash = password_hash($pwd, algo: PASSWORD_BCRYPT);
    $sql = "INSERT INTO users (username, firstname, lastname, email, mobile,
                                age, maingoal, likes, dislike, available, 
                                pwd, profilepicture ) 
            VALUES ('$user', '$first', '$last', '$email', '$mobile', 
                    '$age', '$goal', '$fav', '$dislike', '$available', 
                    '$hash', '$target_file')";

    if ($conn->query($sql) === TRUE) {
        echo '<div>';
        echo '<p>' . "Your account has been registered. Please click Login to proceed to your account. Thank you." . '</p>';
        echo '</div>';
    } else {
        echo "Error: " . $sql . "<br>" . $conn->error;
    }
}


$conn->close();
?>
RiggsFolly
  • 93,638
  • 21
  • 103
  • 149
Chris
  • 1
  • 1
    Named parameters will work since PHP 8.0 – Markus Zeller May 31 '22 at 09:00
  • I don't see anywhere in the doc where you need to add `algo:` into the code. I certainly don't do that when I use `password_hash()`. – droopsnoot May 31 '22 at 09:07
  • 1
    Your script is open to [SQL Injection Attack](http://stackoverflow.com/questions/60174). Even [if you are escaping inputs, its not safe!](http://stackoverflow.com/questions/5741187) You should always use [prepared parameterized statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) in either the `MYSQLI_` or `PDO` API's instead of concatenating user provided values into the query. Never trust ANY user input! – RiggsFolly May 31 '22 at 09:48
  • We have to assume you are not using PHP8 – RiggsFolly May 31 '22 at 09:51
  • I deleted algo: and this fixed the problem. I'm new to this malarky. Thanks Droopsnoot. – Chris May 31 '22 at 19:33

0 Answers0