Signup page is the page that users submit their username and passwords , so that they would be registered users and they can login again in the future.
For the appearance of the signup page we need a form with input fields and buttons to input the data:
Make a page with "signup.php" name and enter these simple codes in it , it contains a verification field that you can find out about it in : http://webprogram4beginners.blogspot.com/2011/02/how-to-make-verification-text-field.html
code:
<?php
session_start();
include ("funcs.php");
if($_SESSION["repeated_usr"] == 1){
// to show that the entered username has been selected before by an other user so it's not available to choose.
echo "please choose an other username , this is repeative";
}
if($_SESSION["Security_code_error"] == 1){
// to show that the security code has not been entered correctly
echo "please enter the secuity code correctly";
}
create_code(); // see it in the post about verification field
?>
<br>
PLease enter username and passwords contain only numbers, Capital and Small letters and space
<BR>
<BR>
<FORM ACTION="mysql_1.php" METHOD=POST>
user NAME:
<INPUT TYPE="TEXT" NAME="usr" SIZE="30" >
<BR>
<BR>
password:
<INPUT TYPE="PASSWORD" NAME="pasw" SIZE="30" >
<BR>
<BR>
<INPUT TYPE="TEXT" NAME="SecCode" SIZE="30" >
<BR>
<img src="security_image.php">
<BR>
<BR>
<INPUT TYPE="SUBMIT" NAME="BUTTON2" VALUE="sign up">
</FORM>
When a user click on the submit button he is directed in to "mysql_1.php" page that analyzes the entered username , password and security code.
The Following codes are contents of this page ("mysql_1.php").
code:
<?php
session_start();
$_SESSION["Security_code_error"]=0; // a session element to check the security code (verification text) that should be entered correctly by user
$_SESSION["repeated_usr"] = 0; // a session element to check if the entered username has already been selected by an other user , or not?
include ("funcs.php"); // functions look like connect (to connect to the database) and creatcode (for verification text) can be put in a file and then we included that file wherever it is required.
if(!$_POST["usr"] or !$_POST["pasw"]){
// if the username or password field is empty the browser is redirected to "signup.php" page.
header("Location: signup.php");
exit;
}
$UserSecCode = strtolower($_POST["SecCode"]); // change all of the letters in to lower case
$SysSecCopde = strtolower($_SESSION["SecImageStr"]);
if($UserSecCode != $SysSecCopde){
// if security code is not entered correctly , the browser is redirected to "signup.php" page.
$_SESSION["Security_code_error"] = 1; // this variable is sent to signup page to show the appropriate message.
header("Location: signup.php");
exit;
}
// these are some processes that you can do over the enteries to prevent from database injection (hacking)
$entered_usr=$_POST["usr"];
$entered_pass=$_POST["pasw"];
$entered_usr=trim($entered_usr); // omit the space characters from the begin and end of the word
$entered_pass=trim($entered_pass);
$entered_usr = htmlspecialchars($entered_usr); // change any entery in to non-html characters (hackers may enter html characters in to your system)
$entered_pass = htmlspecialchars($entered_pass);
if(ereg("[^a-zA-z0-9\ ]",$entered_usr)){
// this condition checks the configuration of the entered username. The username should contain only capital and small letters and numbers.
$_SESSION["repeated_usr"] = 1; // we redirect the user to signup page , but I haven't used any new session element to show this issue.
header("Location: signup.php");
exit;
}
// an other series of processes over data to prevent database injection (hacking) , I'm too much cautious , you can omit them.
$entered_usr = str_replace("'", "", $entered_usr);
$entered_pass = str_replace("'", "", $entered_pass);
$entered_usr = str_replace("\\", "", $entered_usr);
$entered_pass = str_replace("\\", "", $entered_pass);
// first we check if the entered username is repeative , or not?
$Sql = "SELECT COUNT(*) FROM users WHERE username='$entered_usr' ";
connect();
$Result = mysql_query($Sql) or die(mysql_error() . "<br>SQL: " . $Sql);
if(mysql_result($Result, 0) > 0 ){
$_SESSION["repeated_usr"] = 1;
header("Location: signup.php");
exit;
}else{
// if the entered username has no problem now we can enter username , password and date in to our database
$Today = date("Ymd");
$salt = "qw";
$entered_pass = crypt($entered_pass,$salt); // we crypt the password not to be recovered easily.
$sql = "INSERT INTO users (username,password,joindate) VALUES ('$entered_usr','$entered_pass','$Today')";
mysql_query($sql);
$_SESSION["auth_usr"]=$entered_usr; // this session shows that the user has been registered and he is now loged in.
$dd = $_SESSION["d"]; // this session element contains the page (address) that the user has been redirected from it.
header("Location: $dd");
exit;
}
?>
If you couldn't understand about the codes here go to the following posts to read more about the orders I have used here:
http://webprogram4beginners.blogspot.com/2011/02/redirect-user-to-login-page-sessions.html
http://webprogram4beginners.blogspot.com/2011/02/php-orders-to-work-with-database-and.html
Just one more case about crypt function:
The crypted text result = crypt ( the text that we want to encrypt , $salt );
This function encrypt words by use of the variable $salt. if you use a two characters salt then the two first characters of the encrypted result always would be your salt.
for example :
code:
$pass = "v1" ;
$salt = "qw";
$result = crypt($pass,$salt);
Then "$result" would be :
$result = "qwbw9k/vI9OlY"
As you can see , you can extract $salt from the encrypted data over your database just by selecting the first two characters of $result.