I am relatively new at using PHP, and I am looking for experienced PHP/HTML users to have a look at my script and offer up any advice on what could have been done better or info on any discovered errors.
<!DOCTYPE HTML>
<html lang="en">
<head><meta charset="UTF-8">
<title>Registration</title>
</head>
<body>
<?php
$page_title = 'Register';
include ('includes/header.html');
# conditional test to only execute contained statements if form has been submitted.
if ($_SERVER['REQUEST_METHOD'] == 'POST')
{
# statements to be inserted here.
# open database connection and initialise array for error messages.
require ('../connect_db.php');
$errors = array();
# stores error msg if firstname field remains empty, or store value in a variable.
if (empty($_POST['firstname']))
{$errors[] = 'Please enter your first name.';}
else
{$fn = mysqli_real_escape_string($dbc,
trim($_POST['firstname']));}
# stores error msg if lastname field remains empty, or store value in a variable.
if (empty($_POST['lastname']))
{$errors[] = 'Please enter your last name.';}
else
{$ln = mysqli_real_escape_string($dbc,
trim($_POST['lastname']));}
# stores error msg if address field remains empty, or store value in a variable.
if (empty($_POST['address']))
{$errors[] = 'Please enter your address.';}
else
{$a = mysqli_real_escape_string($dbc,
trim($_POST['address']));}
# stores error msg if town field remains empty, or store value in a variable.
if (empty($_POST['town']))
{$errors[] = 'Please enter your town.';}
else
{$t = mysqli_real_escape_string($dbc,
trim($_POST['town']));}
# stores error msg if postcode field remains empty, or store value in a variable.
if (empty($_POST['postcode']))
{$errors[] = 'Please enter your postcode.';}
else
{$pc = mysqli_real_escape_string($dbc,
trim($_POST['postcode']));}
# stores error msg if email field remains empty, or store value in a variable.
if (empty($_POST['email']))
{$errors[] = 'Please enter your email.';}
else
{$e = mysqli_real_escape_string($dbc,
trim($_POST['email']));}
# stores error msg if username field remains empty, or store value in a variable.
if (empty($_POST['username']))
{$errors[] = 'Please enter your username.';}
else
{$u = mysqli_real_escape_string($dbc,
trim($_POST['username']));}
# stores password as a variable if both password fields match, or store an error msg if not matching or first field is empty.
if (!empty($_POST['password1']))
{
if ($_POST['password1'] != $_POST['password2'])
{$errors[] = 'Passwords do not match.';}
else
{$p = mysqli_real_escape_string($dbc,
trim($_POST['password1']));}
}
else {$errors[] = 'Please enter your password.';}
# stores error msg if email already exists in database.
if (empty($errors))
{
$q = "SELECT username FROM users WHERE email='$e'";
$r = mysqli_query ($dbc,$q);
if (mysqli_num_rows($r) != 0)
{$errors[] = 'Email address already registered.
<a href="login.php">Login</a>';}
}
# stores user data in database and displays a confirmation message when registration is successful, closes the database connection and includes a page footer as well as exit the script.
if (empty($errors))
{
$q = "INSERT INTO users
(firstname, lastname, address, town, postcode, email, username, password)
VALUES ('$fn', '$ln', '$a', '$t', '$pc', '$e', 'u', SHA1('$p'))";
$r = mysqli_query ($dbc,$q);
if ($r)
{
echo '<h1>Registered!</h1>
<p>You are now registered.</p>
<p><a href="login.php">Login</a></p>';
}
mysqli_close($dbc);
include ('includes/footer.html');
exit();
}
# displays all stored error msg when registration fails and closes database connection.
else
{
echo '<h1>Error!</h1>
<p id="err_msg">The following error(s) occurred:<br>';
foreach ($errors as $msg)
{
echo " -$msg<br>";
}
echo 'Please try again.</p>';
mysqli_close($dbc);
}
}
?>
<!--Sticky HTML form-->
<h1>Register</h1>
<form action="register.php" method="POST">
<p>
First Name: <input type="text" name="firstname"
value="<?php if (isset($_POST['firstname']))
echo $_POST['firstname'];?>">
Last Name: <input type="text" name="lastname"
value="<?php if (isset($_POST['lastname']))
echo $_POST['lastname'];?>">
</p><p>
Address: <input type="text" name="address"
value="<?php if (isset($_POST['address']))
echo $_POST['address'];?>">
Town: <input type="text" name="town"
value="<?php if (isset($_POST['town']))
echo $_POST['town'];?>">
Postcode: <input type="text" name="postcode"
value="<?php if (isset($_POST['postcode']))
echo $_POST['postcode'];?>">
</p><p>
Email Address: <input type="text" name="email"
value="<?php if (isset($_POST['email']))
echo $_POST['email'];?>">
</p><p>
Username: <input type="text" name="username"
value="<?php if (isset($_POST['username']))
echo $_POST['username'];?>">
</p><p>
Password: <input type="password" name="password1"
value="<?php if (isset($_POST['password1']))
echo $_POST['password1'];?>">
Confirm Password: <input type="password" name="password2"
value="<?php if (isset($_POST['password2']))
echo $_POST['password2'];?>">
</p><p>
<input type="submit" value="Register"> </p>
</form>
<?php include ('includes/footer.html');?>
</body>
</html>