I would like to ask the experts here if this is secure. If it is not can I get an explanation as to why it would not be secure? I have been reading off and on on sites for this and I have trouble understanding a couple of things.
Here is the main registration script:
<?php
$name = $_POST['username'];
$password = $_POST['password'];
$email = $_POST['email'];
$hash = md5 (rand(0,1000));
if(isset($name))
{
if (trim($name) == '' || trim($name) == ' ')
{
print_r('Username cannot be empty');
}
else
{
if(preg_match('/^[a-zA-Z0-9]{5,}$/', $name))
{ // for english chars + numbers only
if( strlen($password) < 8 ) { print_r("Password too short!"); }
elseif( !preg_match("#[0-9]+#", $password) ) { print_r("Password must include at least one number!"); }
elseif( !preg_match("#[a-z]+#", $password) ) { print_r("Password must include at least one letter!"); }
elseif( !preg_match("#[A-Z]+#", $password) ) { print_r("Password must include at least one CAPS!"); }
elseif( !preg_match("#\W+#", $password) ) { print_r("Password must include at least one symbol!"); }
else
{
if(isset($_POST['submit']))
{
if(filter_var($email, FILTER_VALIDATE_EMAIL))
{
$subject = 'Signup | Verification'; // Give the email a subject
$message = '
Thanks for signing up!
Your account has been created, you can login with the following credentials after you have activated your account by pressing the url below.
------------------------
Username: '.$name.'
Password: '.$password.'
------------------------
Please click this link to activate your account:
http://www.mywebsite.com/verify.php?email='.$email.'&hash='.$hash.'
'; // Our message above including the link
$headers = 'From:[email protected]' . "\r\n"; // Set from headers
if(!isset($con))
{
$config = parse_ini_file('config2.ini');
$con = mysqli_connect(`localhost`,$config["username"],$config["password"],$config["dbname"])or die ("MySQL Error: " . mysqli_connect_error());
}
$stmt = $con->prepare("SELECT login FROM Accounts WHERE login=?");
$stmt->bind_param("s", $GLOBALS['name']);
$stmt->execute();
$stmt->bind_result($un);
$usernamefound = 'false';
while ($stmt->fetch())
{
if(isset($un))
{
$usernamefound = 'true';
print_r ('Username already exists.');
}
}
$stmt->close();
if ($usernamefound == 'false')
{
if (filter_var($_SERVER['REMOTE_ADDR'], FILTER_VALIDATE_IP) || filter_var($_SERVER['REMOTE_ADDR'], FILTER_VALIDATE_IP, FILTER_FLAG_IPV6))
{
$ip = filter_var($_SERVER['REMOTE_ADDR']);
mail($email, $subject, $message, $headers); // Send our email
$hashed_password = password_hash($GLOBALS['password'], PASSWORD_DEFAULT);
$result = $con->prepare('INSERT INTO Accounts(login,password,email,lastip,hash) VALUES (?, ?, ?, ?, ?)');
$result->bind_param("sssss", $GLOBALS['name'], $hashed_password, $GLOBALS['email'], $ip, $GLOBALS['hash']);
$result->execute();
$result->close();
$con->close();
echo "Registered: " . $ip;
}
else
{
header('Location: noIPError.html');
die();
}
echo "<br/>";
// Return Success - Valid Email
print_r('Your account has been made, <br /> please verify it by clicking the activation link that has been send to your email.');
}
}
else
{
// Return Error - Invalid Email
print_r('The email you have entered is invalid, please try again.');
}
}
}
}
else
{
print_r('Invalid Username: Must be alphanumeric and longer than or equal to 5 chars');
echo "<br/>";
print_r('No special characters or spaces allowed');
}
}
}
?>
I would really like to know what i am doing wrong when it comes to mysqli_real_escape_string
as well and from what I've been reading it's not even really that secure anyway. What if I do the variables directly and simply just get rid of $name
, $password
and so on all together. Would that be the most secure way to do it?
I'm assuming it's ok for those globals to exist due to the password hash?
If there is any major exploit I'd like to learn about it I guess is what this question is mainly about.
I'm assuming it's ok for those globals to exist due to the password hash?
question? I don't really get what is asked here \$\endgroup\$