PHP - Is Mb_check_encoding Really Required For All Inputs?

Hi!

I wanna know what is the best way to secure my inputs?

Now I'm using something like this function:

public function z($var) {
        $result1 = htmlspecialchars($var);
        $result = mysqli_real_escape_string($this->conn, $result1);
        return $result;
    }

but I don't know how secure it is from all inputs... It couldn't be that with that my site is completely secure...

So I wanna know what else I should use...

I found something about PHP sanitize filters and similar... Same for mail, should I use that for e-mail, what should I use for e-mails as I think this 2 codes will brake character @ necessary for emails.

Any suggestion is welcome

Thanks

I have a form with several text fields.

For example (sorry, no code insert option on my phone)

<form method="post"> Enter value1 :<input type="text" name="str1"><br/> Enter value2 :<input type="text" name="str2"><br/> <input type="submit" >

I would like to scan the INPUTS to determine which fields were left empty.

Using !isset (to the best of my knowledge) would require that I list each input individually.

Is there a PHP alternative that, similar to JavaScript, would allow me to evaluate every INPUT or TEXT field to then list those left empty?

Hi,

I built this reg-login file.

Note, login.php asks for your login details. The webform (so to speak) uses SELECT sql query to check your login credentials.

The reg.php asks for your new acc details. The webform (so to speak) uses INSERT sql query to add your details to db.

I got my webform not displayed to you either as registration form or login form. It is a neutral form. It justs asks you for your email.

Then checks against db. If it exists, it assumes you existing member and login() function takes over and logs you in. Else, registration() functions takes over and registers you.

Note:

On the login(), at the end when user is logged into his member account, his personal details get displayed on screen.
I need you to check if this following line (especially) is correct or not:

if($row = mysqli_fetch_array($result_3,MYSQLI_ASSOC))

1. I want you to see if there any errors in my code that will result in malfunction or hacker sql injecting or hacking.

2. I need you to show me how to VALIDATE user input. VALIDATE email using 1). html5 & 2). php 7 email validation function plus 3.) with REGEX so nothing but email is inputted. Show me these 3 ways to check for email.

I need you to show me how to VALIDATE user password. VALIDATE password using 1). html5 & 2). php 7 & 3.) with REGEX so nothing but password (A-Z, 0-9 ONLY) is inputted. And no other chars. Show me these 3 ways to check for password.

From there,  I should pick on fast from you and manage to VALIDATE username input.

I don't know how to do these above 2 so kindly teach me by showing snippet with comments so i understand your snippet.

NOTE:

I did not complete the password prompt because I have forgotten how to do it with SHA256. Can someone show me a typical example how to query for password with SHA256 or whatever the latest strong algorithm is ? Show me code with comments so I understand what you doing with your code.
I will the modify your snippet a little to suit my purpose and add it on the login().
I know I need to add the password prompt on the registration() too but you don't have to deal with that as I will complete it once I finish learning from you. You just teach me how to do it in the login() and from there I will take it on to add it on the registration().

Thank You!

<?php
	session_start();
	if($_SERVER['REQUEST_METHOD'] == 'POST')
{
    if(!isset($_POST['email_account']) || !isset($_POST['email_service']))
    {
        $email_error = "<font color='red'>Input Email Address!</color>";
    }
    else
    {
        //Connect to Database. (DB_SERVER, BD_USERNAME, DB_PASSWORD, DB_NAME).
        $conn = mysqli_connect("localhost","root","","powerpage");
        $conn->set_charset('utf8mb4'); //Always set Charset.
        
        if($conn === false)
        {
            die("ERROR: Connection Error!. " . mysqli_connect_error());
        }
        else
        {
            //Set Parameters.
            $email = trim($_POST["email_account"]) . '@' . trim($_POST["email_service"]);
            $_SESSION['email'] = trim($_POST["email_account"]) . '@' . trim($_POST["email_service"]);//If this fails on test then replace it with above line
            echo "line 25 triggered: $email<br>";
            
            $sql_query = "SELECT COUNT(personal_email) FROM users WHERE personal_email = ?";
            $stmt = mysqli_prepare($conn,$sql_query);
            if($stmt == False)
            {
                //Close Connection.
                mysqli_close($conn);
                echo "Line 33<br>";//DELETE THIS
                die("<pre>Mysqli Prepare Failed!\n".mysqli_stmt_error($stmt)."\n$sql_query</pre>");
            }
            else
            {
                mysqli_stmt_bind_param($stmt,'s',$email);
                
                if(!mysqli_stmt_execute($stmt))
                {
                    //Close Connection.
                    mysqli_close($conn);                    
                    die("Could not mysqli_stmt_execute! Please try again later!");
                }
                
                $result = mysqli_stmt_get_result($stmt);
                
                if(mysqli_fetch_array($result, MYSQLI_NUM)[0])//WHY THIS NOT WORK UNLESS NUM ARRAY GIVEN ?
                {
                    echo "Line 57 triggered: Function login() will trigger!<br>"; //DELETE THIS
                    $_SESSION['session_type'] = 'login';
                    login();
                
                }
                else
                {
                    echo "Line 61 triggered: Function register() will trigger!<br>"; //DELETE THIS
                    $_SESSION['session_type'] = 'register';
                    register();
                }
            }
        }
    }
}
	function register()
{
    //if(!isset($_SESSION['session_type'] or $_SESSION['session_type'] != 'registration')//Nog Dog's copied & pasted line
    if(!isset($_SESSION['session_type']) || $_SESSION['session_type'] != 'register')
    {
        //Close Statement.
        mysqli_stmt_close($stmt);
        //Close Connection.
        mysqli_close($conn);
        
        die("Line 86: Could not check email! Please try again later!");
    }
    
    //$email = trim($_POST["email_account"]) . '@' . trim($_POST["email_service"]);
    $email = $_SESSION['email'];//If this fails on test then replace it with above line
    
    //Connect to Database. (DB_SERVER, BD_USERNAME, DB_PASSWORD, DB_NAME).
    $conn = mysqli_connect("localhost","root","","powerpage");
    
    //Prepare an INSERT Statement.
    $sql_query_2 = "INSERT INTO users (personal_email) VALUES (?)";
    
    if(!$stmt_2 = mysqli_prepare($conn,$sql_query_2))
    {
        //Close Connection.
        mysqli_close($conn);
        die("Could not register! Please try again later!");
    }
    else
    {
        //Bind Variables to the Prepared Statement as parameters.
        mysqli_stmt_bind_param($stmt_2,'s',$email);
        
        //Attempt to execute the Prepared Statement.
        if(!mysqli_stmt_execute($stmt_2))
        {
            //Close Statement.
            mysqli_stmt_close($stmt_2);
            //Close Connection.
            mysqli_close($conn);
            die("Could not register! Please try again later!");
        }
        mail();
    }
}
	function login()
{
    if(!isset($_SESSION['session_type']) || $_SESSION['session_type'] != 'login')
    {
        //Close Statement.
        mysqli_stmt_close($stmt);                
        //Close Connection.
        mysqli_close($conn);
        
        die("Could not check email! Please try again later!");
    }
    
    //$email = trim($_POST["email_account"]) . '@' . trim($_POST["email_service"]);
    $email = $_SESSION['email'];//If this fails on test then replace it with above line
    
    //Connect to Database. (DB_SERVER, BD_USERNAME, DB_PASSWORD, DB_NAME).
    $conn = mysqli_connect("localhost","root","","powerpage");
    
    //Prepare a Select Statement.
    $sql_query_3 = "SELECT id,username,first_name,middle_name,surname,gender,age_range FROM users WHERE personal_email = ?";
    if(!$stmt_3 = mysqli_prepare($conn,$sql_query_3))
    {
        //Close Statement.
        mysqli_stmt_close($stmt_3);
        //Close Connection.
        mysqli_close($conn);
        
        die("Could not check email! Please try again later!");
    }
    else
    {
        //Bind Variables to the Prepared Statement as parameters.
        mysqli_stmt_bind_param($stmt_3,'s',$email);
        
        //Attempt to execute the Prepared Statement.
        if(!mysqli_stmt_execute($stmt_3))
        {
            //Close Statement.
            mysqli_stmt_close($stmt_3);
            //Close Connection.
            mysqli_close($conn);
            
            die("Could not check email! Please try again later!");
        }
        //mysqli_stmt_bind_result($stmt,$email);        
        
        $result_3 = mysqli_stmt_get_result($stmt_3);
        
        //if(mysqli_fetch_array($result_3, MYSQLI_NUM))
        
        //Fetch result row as an associative array. Since the result set contains only one row, we don't need to use the 'While loop'.
        //mysqli_stmt_fetch($stmt);//use this if you use 'mysqli_stmt_bind_result($stmt,$email).
        if($row = mysqli_fetch_array($result_3,MYSQLI_ASSOC)) //Use this if you use '$result = mysqli_stmt_get_result($stmt)' instead of 'mysqli_stmt_bind_result($stmt,$email)'.
        {
            //Retrieve Values.
            $id = $row["id"];//Use this if you use '$result = mysqli_stmt_get_result($stmt)' instead of //'mysqli_stmt_bind_result($stmt,$email_count)';
            $username = $row["username"];//Use this if you use '$result = mysqli_stmt_get_result($stmt)' instead of //'mysqli_stmt_bind_result($stmt,$email_count)';
            $first_name = $row["first_name"];//Use this if you use '$result = mysqli_stmt_get_result($stmt)' instead of //'mysqli_stmt_bind_result($stmt,$email_count)';
            $middle_name = $row["middle_name"];//Use this if you use '$result = mysqli_stmt_get_result($stmt)' instead of //'mysqli_stmt_bind_result($stmt,$email_count)';
            $surname = $row["surname"];//Use this if you use '$result = mysqli_stmt_get_result($stmt)' instead of //'mysqli_stmt_bind_result($stmt,$email_count)';
            $gender = $row["gender"];//Use this if you use '$result = mysqli_stmt_get_result($stmt)' instead of //'mysqli_stmt_bind_result($stmt,$email_count)';
            $age_range = $row["age_range"];//Use this if you use '$result = mysqli_stmt_get_result($stmt)' instead of //'mysqli_stmt_bind_result($stmt,$email_count)';
        
            echo "Id: $id<br>";
            echo "Username: $username<br>";
            echo "First Name: $first_name<br>";
            echo "Middle Name: $middle_name<br>";
            echo "Surname: $surname<br>";
            echo "Gender: $gender<br>";
            echo "Age Range: $age_range<br>";
            
            //Close Statement.
            mysqli_stmt_close($stmt_3);
            //Close Connection.
            mysqli_close($conn);
        }
    }
}
	//DO NOT NEED TO REDO THE HTML CODE BELOW AS WAS NOT COPY & PASTE FROM ELESEWHERE ....
?>
	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
	<head>
<meta name="viewport" content="width=device=width, initial-scale=1">
</head>
	<body>
	<form action="" method="post">
<label for="email_account">Email:</label>
<input type="text" name="email_account" id="email_first_part" placeholder="Email Address before '@'">
<label for="email_service"><b>@</b></label>
<input type="text" name="email_service" id="email_last_part" placeholder="Email Address after '@'">
<?php if(!empty($email_error)){echo $email_error;}?>
<br>
<button type="submit" class="login_register" name="login_register">Register/Login</button>
</body>
<html>
<?php
?>

My PHP code for mySQL query result:

echo '<input type="text" value="' . $row [ "dollar_amount" ] . '" onInput = "submit();" >';

This yields a neat HTML column of retrieved prices on my PHP page that looks kinda like this

<input type="text" value="19.99" onInput="submit();">
<input type="text" value="7.55" onInput="submit();">
<input type="text" value="10.00" onInput="submit();">
<input type="text" value="4.99" onInput="submit();">
<input type="text" value="12.75" onInput="submit();">

Desired Effect:
I want to change the "10.00" amount to "20.00" simply by typing and entering "20.00" where it says "10.00" and have the form submit and update that specific mySQL record.

Question:
What's the best way to capture that specific post variable?

Problems I've Encountered:
1. The page has several inputs and submit buttons, thus all kinds of different $_POST variables exist.
2.) I could add "name = $unique_order_number" to each input field, but when I submit the form, I still have to have PHP loop through everything.
3.) I could add "name" and have it match "value" (e.g. <input name="$row['dollar_amount']" value="$row['dollar_amount']")

It seems the only way to do this is to have PHP loop through EVERY post variable every time anything is posted and this seems inefficient.

Example:
(to make this inefficient example work, I would have to append "updatedollar" to the name, like "updatedollar".$row[dollar_amount'] )

foreach($_POST as $var = $val) { // loop through all the posts on the page
   if(substr($var,0,12) == 'updatedollar') { // make sure it's an "updatedollar" post and not one of the other posts on the page.
      if(substr($var,12) != $val) { // get rid of "updatedollar" part and see if it's the value I wanted changed

      // do a mysql update query and update the table

      }
   }
}

So, there has to be a better way?

Thank you.

Customers visit a "select merchandise page."
Their list of items is displayed (merchandise SKU numbers). The displayed list of their expands as they add more stuff.
When they're done, they create a packing slip that appears on a new "finished.php" page.

Question: Is using 2 forms and hidden inputs the secure and accepted way to do this?

--------------------------------------------------------
<?php
$added = $_POST["added"] . ',' . $_POST["more-stuff"];
echo "Here is what's been added: $added"; // item 1, item 2, item 3, etc.
?>

<form method="post" action="<?=$SERVER['PHP_SELF']?>">
<input type="text" name="added">
<input type="hidden" name="more-stuff" value="<?=$added?>">
</form>

When finished, click here to create Packing Slip:

<form method="post" action="finished.php">
<input type="submit" value="CREATE PACKING SLIP">
<input type="hidden" name="finished" value="<?=$added?>">
</form>
--------------------------------------------------------

Thank you!!