Please review my registration code and suggest what changes I should make to improve security. I'm new to PHP and this is my first project.
Also I have no Idea how to make a "forget password page" as I've used password_hash
to store passwords in database.
<!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>VALIDATION FORM - REGISTER</title>
<link href="style.css" rel="stylesheet" type="text/css">
<script src="js/gen_validatorv4.js" type="text/javascript"></script>
</head>
<body>
<?php
<!--FILE TO CONNECT TO DATABASE AND INSERTION-->
include 'register_db_check.php';
?>
<!--PHP FLE TO CHECK VALIDATION-->
<?php include 'register_validation.php';?>
<h2>DomainName.com - REGISTER</h2>
<!--NAVBAR-->
<div>
<nav class="navBar"><a href="login.php"> Login </a> | <a href="register.php"> Register </a> | <a href="#"> Contact Us </a></nav>
</div>
<!--FORM STARTS HERE-->
<form name="myForm" id="form" enctype="multipart/form-data" method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>">
<table>
<tr>
<!--USERNAME FIELD-->
<td>User Name :</td>
<td>
<input type="text" placeholder="Enter User Name Here" name="uname" id="uname" size="35" value="<?php echo $uname;?>">
<span class="error">* <?php echo $unameErr;?>
</span>
</td>
</tr>
<!--NAME FIELD-->
<tr>
<td>Name :</td>
<td><input type="text" placeholder="Enter Name Here" name="name" id="name" size="35" value="<?php echo $name;?>">
<span class="error">* <?php echo $nameErr;?></span>
</td>
</tr>
<!--FNAME FIELD-->
<tr>
<td>Father Name : </td>
<td><input type="text" placeholder="Enter Father Name Here" name="fname" id="fname" size="35" value="<?php echo $fname;?>">
<span class="error">* <?php echo $fnameErr; ?></span>
</td>
</tr>
<!--EMAIL FIELD-->
<tr>
<td>E-mail : </td>
<td><input type="text" name="email" id="email" placeholder="Enter Valid E-mail Here" size="35" value="<?php echo $email;?>">
<span class="error">* <?php echo $emailErr; ?></span>
</td>
</tr>
<!--PASSWORD FIELD-->
<tr>
<td>Password :</td>
<td><input type="password" placeholder="Enter Password Here" name="password" id="password"size="35" value="<?php echo $pass;?>">
<span class="error">* <?php echo $passErr; ?></span>
</td>
</tr>
<!--MOBILE NUMBER-->
<tr>
<td>Mobile Number :</td>
<td><input type="tel" placeholder="Enter Valid PH No. Here" name="mnum" id="mnum" size="35" value="<?php echo $mnum;?>">
<span class="error">* <?php echo $mnumErr; ?></span>
</td>
</tr>
<!--INTEREST FIELD-->
<tr>
<td>Interests :</td>
<td><textarea name="interest" id="interest" cols="40" rows="5"><?php echo $intrs;?></textarea><span class="error">* <?php echo $intrsErr;?>
</span>
</td>
</tr>
<!--RADIO BUTTON-->
<tr>
<td>Gender: </td>
<td>
<input type="radio" name="sex" value="Male" <?php if(isset($sex) && $sex == "Male") echo "Checked";?> >Male
<input type="radio" name="sex" value="Female" <?php if(isset($sex) && $sex == "Female") echo "Checked";?> >Female
<span class="error">* <?php //echo $sexErr; ?></span> </td>
</tr>
<!--Captcha Image!-->
<tr><td></td>
<td><img id="captcha" src="/securimage/securimage_show.php" alt="CAPTCHA Image"/></td>
<tr><td>Enter Captcha Here: </td><td><input type="text" name="captcha_code" size="10" maxlength="6" >
</td></tr>
</tr>
<tr><td><a href="#" onclick="document.getElementById('captcha').src = '/securimage/securimage_show.php?' + Math.random(); return false"></a>
</td></tr>
<!--REGISTER BUTTON-->
<tr>
<td></td>
<td>
<input type="submit" value="Register" name="reg" class="regbtn" ></td>
</tr>
<tr><td></td>
<!--OR BUTTON-->
<td><h3>OR</h3></td></tr>
<tr><td></td>
<!--SIGN-IN BUTTON-->
<td><h3>Click Below To Sign In From Your ID</h3></td>
</tr>
<tr><td></td>
<td><a href="login.php"><input type="button" value="Sign-in" name="button" id="sbtn"></a></td>
</tr>
</table>
</form>
<!--FORM VALIDATION JAVASCRIPT-->
<script type="text/javascript">
var frmvalidator = new Validator("myForm");
frmvalidator.addValidation("uname","req","Please enter a Valid User Name");
frmvalidator.addValidation("name","req","Please enter your First Name");
frmvalidator.addValidation("fname","req","Please enter your Father Name");
frmvalidator.addValidation("email","req","Please enter your Email");
frmvalidator.addValidation("email","email","Please enter Valid Email");
frmvalidator.addValidation("mnum","numeric","Only digits are allowed");
chktestValidator.addValidation("sex","selone_radio","Select atleast one");
</script>
<div class="footer">
<?php include('footer.php');?>
</div>
</body>
</html>
register_db_check.php
<?php
include_once $_SERVER['DOCUMENT_ROOT'] . '/securimage/securimage.php';
$securimage = new Securimage();
?>
<?php
require('connect.php');
// If the values are posted, insert them into the database.
if (isset($_POST['uname']) && isset($_POST['password']) && isset($_POST['fname']) && isset($_POST['email'])
&& isset($_POST['password']) && isset($_POST['mnum']) && isset($_POST['interest']) && !empty($_POST['mnum']))
{
$uname = $_POST['uname'];
$name = $_POST['name'];
$fname = $_POST['fname'];
$email = $_POST['email'];
$pass = password_hash($_POST['password'], PASSWORD_DEFAULT);
$mnum = $_POST['mnum'];
$intrs = $_POST['interest'];
$sql = mysqli_query($conn, "SELECT * FROM `guests` WHERE email = '".$email."'");
if(mysqli_num_rows($sql) > 0) {
header ("Location:register.php?error=Email already exist.");
exit();
}
$sql = mysqli_query($conn, "SELECT * FROM `guests` WHERE uname = '".$uname."'");
if(mysqli_num_rows($sql) > 0) {
/*print '<script>alert("Username already In Use!");</script>'; //Prompts the user
print '<script>window.location.assign("register.php");</script>';*/ //redirects to login.php
header ("Location:register.php?error=Username already exist.");
exit();
}
$result = mysqli_query($conn, "INSERT INTO `guests`(uname, name, fname, email, password, mnum, interest) VALUES ('$uname','$name','$fname','$email','$pass','$mnum', '$intrs')") or die(mysqli_connect_error());
if($result == TRUE && isset($_POST['captcha_code']) && $securimage->check($_POST['captcha_code']) == !false) {
header('Location:/FvWithCaptcha/thankyou.php');
}
elseif ($result == FALSE || $result == NULL || $securimage->check($_POST['captcha_code']) == false) {
echo "Error in registration";
}
mysqli_close($conn);
?>
Any tutorials are also appreciated!
register_validation.php
<?php
$unameErr = $nameErr = $fnameErr = $emailErr = $passErr = $mnumErr = $sexErr = $intrsErr = "" ;
$uname =$name = $fname = $email = $pass = $mnum = $sex = $intrs = "" ;
if ($_SERVER["REQUEST_METHOD"] == "POST") {
if(empty($_POST["uname"])) {
$unameErr = "User Name Is Required";
}
else
{
$uname = test_input($_POST["uname"]);
}
if(empty($_POST["name"])) {
$nameErr = "Name Is Required";
}
else
{
$name = test_input($_POST["name"]);
//Condition Check
if(!preg_match("/^[a-zA-Z ]*$/", $name)){
$nameErr = "Only Letters are allowed";
}
}
if(empty($_POST["fname"])){
$fnameErr = "Father Name Is Required";
}
else
{
$fname = test_input($_POST["fname"]);
//Condition Check
if(!preg_match("/^[a-zA-Z ]*$/", $fname)){
$fnameErr = "Only Letters are allowed";}
}
if(empty($_POST["email"])){
$emailErr = "Email Required";
}
else {
$email = test_input($_POST["email"]);
//Condition Check
if(!filter_var($email, FILTER_VALIDATE_EMAIL)) {
$emailErr = "Enter Valid E-mail";
}
}
if(empty($_POST["mnum"])){
$mnumErr = "PH No. Required";
}
else {
$mnum = test_input($_POST["mnum"]);
if(preg_match("/[^0-9]/", $mnum))
{
$mnumErr = "Only Digits are allowed";
}
}
if(empty($_POST["password"])){
$passErr = "Password Required";
}
else {
$pass = test_input($_POST["password"]);
}
if(empty($_POST["sex"])){
$sexErr = "Gender is Required";
}
else {
$sex = test_input($_POST["sex"]);
}
if(empty($_POST["interest"])) {
$intrsErr = "Show some Interest please!";
}
else {
$intrs = test_input($_POST["interest"]);
}
}
function test_input($data) {
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
return $data;
}
?>