PHP - Add Username And Password To Array

Took Skoglund's Lynda course on creating a CMS for a project I am doing for a customer.

I was extremely careful to set up the database, and pretty much copying everything he was doing in the course.

So, I try to create a user in the database, and....crickets.  Name and password don't come up.  No error messages from the site.  Just, nothing.  So I'm sure it's pretty simple to fix, otherwise, there would have been chaos, right?

For the page: hawcreekrenovations.com/new_user.php

We know the page is correctly connecting to the MySQL because the drop down in the form is populated by the user-types in the database.

So, I guess, you need the pertinent code:

Code: [Select]
// START FORM PROCESSING
if (isset($_POST['submit'])) { //Form has been submitted
$errors = array();

// perform validations on the form data
$required_fields = array('username', 'password', 'user_type_id' );
$errors = array_merge($errors, check_required_fields($fields_with_lengths, $_POST));

$fields_with_lengths = array('username' => 30, 'password'=> 30);
$errors = array_merge($errors, check_max_field_lengths($fields_with_lengths, $_POST));

$username = trim(mysql_prep($_POST['username']));
$password = trim(mysql_prep($_POST['password']));
$hashed_password = sha1($password);
$user_type_id = trim(mysql_prep($_POST['user_type_id']));

if ( empty($errors) ) {
$query = "INSERT INTO users (
username, hashed_password, user_type_id
) VALUES (
'{$username}', '{$hashed_password}', '{$user_type_id}'
)";
$result = mysql_query($query, $connection);
if ($result) {
$message = "The user was successfully created.";
} else {
$message = "The user could not be created.";
$message .= "<br />" . mysql_error();
}
} else {
if (count($errors) == 1) {
$message = "There was 1 error in the form.";
} else {
$message = "There were " . count($errors) . " erros in the form.";
}
}
} else { // Form has not been submitted.

$username = "";
$password = "";
}
?>
And the form:

Code: [Select]
<form action="new_user.php" method "post">
            <table>
            <tr>
                <td>Username:</td>
                    <td><input type="text" name="username" maxlength="30" value="<?php echo htmlentities($username); ?>" /></td>
                </tr>
                <tr>
                <td>Password:</td>
                    <td><input type="password" name="password" maxlength="30" value="<?php echo htmlentities($password); ?>" ? /></td>
                </tr>
                <tr>
                <td>User Type:</td>
                    <td><?php // 3. Perform database query 
                $result = mysql_query("SELECT * FROM user_type", $connection);
                    if (!$result) { 
                        die("Database query failed: " . mysql_error());
                    }
                // 4. Use returned data (if any) 
                echo "<select name='type'>";
                while ($row = mysql_fetch_array($result)) {
                        echo "<option value=\"".$row["user_type_id"]."\">".$row["type"] . "</option>";
                }
                echo "</select>"; ?></td>
                </tr>
                <tr>
                <td colspan="2"><input type="submit" name="submit" value="Create user" /></td>
                </tr>
            </table>
            </form>

Code: [Select]
<?php
session_start();
include("global-settings.php");
mysql_connect($dbhost, $dbuser, $dbpass)or die("Could Not Connect: " . mysql_error());
mysql_select_db($dbname) or die(mysql_error());

$email = mysql_real_escape_string(strip_tags($_POST["email"]));
$password = sha1($_POST["password"]);
$result = mysql_query("SELECT * FROM users WHERE email = '{$email}' AND password = '{$password}'");
if (mysql_num_rows($result) > 0) {
$row = mysql_fetch_array($result);
$_SESSION["userid"] = $row['user_pid'];
echo "logged in";
} else {
$userid_generator = uniqid(rand(), false);
mysql_query("INSERT INTO users (user_pid, email, password, datetime_registered, is_leader) VALUES ('$userid_generator', '{$email}', '{$password}', NOW(), 'no')");
$id = mysql_insert_id();
$leaders = mysql_query("SELECT * FROM users WHERE is_leader LIKE '%yes%'");
while($rows = mysql_fetch_array($leaders)) {
if ($rows['is_leader'] == 'yes') {
$leader_id = $rows['user_pid'];
mysql_query("INSERT IGNORE INTO friends (node1id, node2id, friends_since, friend_type)
VALUES('$leader_id', '$userid_generator', NOW(), 'full')");
$_SESSION["userid"] = $userid_generator;
echo "new user created and logged in";

if(is_dir($userid_generator)) {
echo "Something wen't wrong. A bug report has been sent and we are doing what we can to fix it.";
$message = 'Registration problem on account number $userid_generator. The user succesfully registered, but there is already
a directory with the account id of $userid_generator.';
mail($bug_report_email, "Registration Bug!", $message);
} else {
mkdir('../media/User-PID{' . $userid_generator . '}', 0777);
mkdir('../media/User-PID{' . $userid_generator . '}/photos', 0777);
mkdir('../media/User-PID{' . $userid_generator . '}/backups', 0777);
mkdir('../media/User-PID{' . $userid_generator . '}/videos', 0777);
mkdir('../media/User-PID{' . $userid_generator . '}/documents', 0777);
mkdir('../media/User-PID{' . $userid_generator . '}/developer', 0777);
mkdir('../media/User-PID{' . $userid_generator . '}/developer/apps', 0777);
mkdir('../media/User-PID{' . $userid_generator . '}/developer/themes', 0777);
mkdir('../media/User-PID{' . $userid_generator . '}/xml', 0777);
}

}
}
}
?>
It logs in fine. It even registers fine, but how do I code it to do something if username is correct but password isn't correct?

There is a login page called login.php, after user type their username and password into textbox, then the page direct it to the page validate, which is validate.php. In validate.php, if user do not type anything, then direct it to the login.php again; if user type their username and password worng less than 3 times, then direct it to the login.php also. However, if user type their username and password more than 3 times, then direct it to the register.php.   Question: i don't know how to make 3 attempts (maybe there are something worng in my page), it doesn't work, Please help, here is my validate.php

<?php
$loginErrorV = false;
$loginErrorW = false;
if(!empty($_POST['username']) && !empty($_POST['password']) && strlen($_POST['username'])!=0 && strlen($_POST['password'])!=0)
{
	//
	$username = $_POST['username'];
	$password = $_POST['username'];

	//Connect to Database
	$conn = mysql_connect("localhost", "root", "");
	if(!$conn){
		die('Could not connect:'.mysql_error());
	}
	mysql_select_db("logindb", $conn);

	//
	$sql = "Select count(username) as user_exist from logint where username = '$username' and password = '$password'";
	$result = mysql_query($sql, $conn);
	$row = mysql_fetch_assoc($result);

	//
	if($row['user_exist'] == 1){
		session_start();
		$_SESSION['username'] = $username;
		header('Location: 10586740.html');
		mysql_close($conn);
	} else {
		$loginErrorV = true;
	}
} else {
	$loginErrorW = true;
}

if($loginErrorV){
	if(isset($_COOKIE['login'])){
		if($_COOKIE['login']<3){
			header('Location:login.php');
			$attempts = $_COOKIE['login'] + 1;
		} else {
			header('Location:register.php');
		}
	}
}

if($loginErrorW){
	header('Location:login.php');
}
?>

I am trying to validate username and password fields. I want to use preg match, but have little knowledge of this function. I want the password to only contain A-z 0-9 and with at least one letter and one number.
Username needs to only include "A-z 0-9 _ -" no spaces in any of these. Here is what I have so far:



$username= $_POST['username'];
$password = $_POST['password'];
$password2 = $_POST['password2'];

if($password==$password2){
if( 
 preg_match("[A-z0-9]", $password) ||
 strlen($password)>6 // at least 7 chars 
|| strlen($password)<26 // at most 20 chars 
){$errors[] = 'Password must contain at least one number and letter plus be between 7-25 characters. May only contain alphanumeric characters, _ and .';} 
}else{$errors[] = 'Your Passwords did not Match';}

 
if( 
preg_match("[A-z0-9_-]", $username) ||
strlen($username)>5 // at least 6 chars 
|| strlen($username)<26 // at most 25 chars
){
$errors[] = 'Username must be 6-25 characters and contain only alphanumeric characters, _ and .'; 
}

Hi Guys,    I have a very simple table called: registered_users   there is only 4 columns    column 1 = id column 2 = username column 3 = password column 4 = salt    the password is hashed and salted when it's added to the table.    The problem is, that my username and password isn't being "seen" by the code so it's not sending me to the next page, it is only sending me back to the login page - not validated.    Please could you help me understand what i may be doing wrong here, it all looks okay to me but that's not obviously the case?    Here is the validation for username and password to login: 

/* validate the username and the password */
if((!isset($_POST['username'])) || (strlen(trim($_POST['username'])) <5) || (trim($_POST['username']) != preg_replace("/[^a-zA-Z0-9\_]/", "", trim($_POST['username'])))) {	
	/* if  is bad */
	$my_error = 1;
}else{
	$username = mysql_real_escape_string(trim($_POST['username']));
}
/* END validating username */

/* validate the password */
if((!isset($_POST['password'])) || (strlen(trim($_POST['password'])) <5) || (trim($_POST['password']) != preg_replace("/[^a-zA-Z0-9\_]/", "", trim($_POST['password'])))){
	/* if  is bad */
	$my_error = 1;
}else{
	$password = trim($_POST['password']);
}
/* END validating password */

/* if any of the post variables are invalid send back to the form page */
if($my_error != 0) {	
	$_SESSION['error_message'] =$error_message;	
	header("Location: index.php");
	exit();
}


/* FUNCTION TO CREATE SALT */
function createSalt(){
	$string = md5(uniqid(rand(), true));
	return substr($string, 0, 3);
}

/* check to see if username is in the table if not send back to login */
$query01 = "SELECT * FROM registered_users WHERE username = '$username'";
$result01 = mysql_query($query01)  or die(mysql_error());

if(mysql_num_rows($result01) != 1) {	
	header("Location: index.php");	
	exit();
 }


$row = mysql_fetch_array($result01);
$salt = $row['salt'];
$hash = hash('sha256', $salt, $password);
$query02 = "SELECT id FROM registered_users WHERE username = '$username' AND password = '$hash'";
$result02 = mysql_query($query02)  or die(mysql_error());
if(mysql_num_rows($result02) !=1){ 
	header("Location: index.php");	
	exit();
}
$_SESSION['id'] = $row['id'];
$_SESSION['valid_user'] = "yes";
header("Location: admin02.php");	
exit();
?>

Thanks Andy
Edited by Ch0cu3r, 05 July 2014 - 09:14 AM.