I just made my first registration form with password confirmation, hashing with BCRYPT and PDO. As a beginner, looking around on StackExchange, I seem to miss a lot.

To keep it simple for myself, I coded PHP and HTML on the same page. Hence I'm just into PHP for 3 days now.

if (isset($_POST['register'])) {

    $name = $_POST['name'];
    $email = $_POST['email'];
    $password = $_POST['password'];
    $cPassword = $_POST['cPassword'];

    $options = [
        PDO::ATTR_EMULATE_PREPARES => false,

    $host = 'localhost';
    $db = 'loginform';
    $user = 'root';
    $pass = '';
    $charset = 'utf8mb4';

    $dsn = "mysql:host=$host;dbname=$db;charset=$charset";

    try {
        $pdo = new PDO($dsn, $user, $pass, $options);
    } catch (\PDOException $e) {
        throw new \PDOException($e->getMessage(), (int)$e->getCode());

    if ($password != $cPassword)
        $msg = "Wachtwoord komt niet overeen!";

    else {

        $hash = password_hash($password, PASSWORD_BCRYPT);

        $sql = "INSERT INTO users (name, email, password) VALUES (?,?,?)";
        $stmt = $pdo->prepare($sql);
        $stmt->execute([$name, $email, $hash]);

        $msg = "U bent geregistreerd!";
        header( "Refresh:3; url=/Login2/inloggen.php", true, 303);


That's a very good code. Speaking of the things that are written in it, there is very little I would change. Only a few things are coming to my mind,

  • I would move the database connection code into a separate file and then just include in other scripts that needed a database connection.
  • Using the Refresh header is old fashioned, inconvenient and buggy. I would rather redirect a user to the newly created account page. So they would know that an account has been created at once.
  • I wouldn't hardcode a particular hashing algorithm, and rather use PASSWORD_DEFAULT instead.

That's all. But of course some things could be added to this code as well. You can add some verifications, like as to see

  • if the username is not empty or already exists
  • whether the password is not strong enough
  • whether email follows the proper format or already exists
  • all other verifications you can think of

And for this purpose it is useful to make $msg not a string but an array of strings, to collect all possible errors in one variable. You can check this approach in my recent answer

| improve this answer | |
  • \$\begingroup\$ I apologize for the late response. I think you covered some interesting things here and to be honest, It's exactly what I needed. At this moment I can use XSS scripts as username and that's something I really don't want. Thank you for reviewing my code, I've set some new goals to work on tonight. Appreciate it! \$\endgroup\$ – Jeremy Stam Mar 12 '19 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.