Some further advice:
1) STOP dropping in and out of php parsing mode. You're just making the code more complex for no good reason. (But again, I'm the guy who thinks <?php and ?> should be removed from the language!)
2) if you're going to copy values into variables, SANITIZE them unless you're using prepared queries. (which you aren't).
3) you don't have to say $msg=$msg." -- $msg.=" is just fine.
4) Do not process unused values until you NEED them... otherwise it's a waste of execution time.
5) INDENT... your missing closes would stand out like a sore thumb then. Simply adding tabs and a few carriage returns can work WONDERS. A few extra spaces in there couldn't hurt either... You've got this... oddball placement of closing brackets and other bits and pieces of the code that's just BEGGING for you to have those types of errors.
6) STOP using double-quotes on your strings. They take longer, and make the code often harder to deal with. (again, WHAT is with people doing that?!?)
7) there is no "and" or "or" for comparisons. Did you mean && and ||?
PHP: Comparison Operators - Manual
8) you lack enough parenthesis in your evaluations. PHP screws up comparisons as && is also a valid compare.... which will run BEFORE your <5
SO... my version would probably looks something more like this:
Code:
<?php
function sanitizeFromPost($postName){
if isset($_POST[$postName]) {
$str=(
get_magic_quotes_gpc() ?
stripslashes($_POST[$postName]) :
$_POST[$postName]
);
return (
function_exists('mysql_real_escape_string') ?
mysql_real_escape_string($str) :
addslashes($str)
);
} else return '';
}
// file name is test_form_ck.php
include "include/db_login.php";// database connection details stored here
// Collect the data from post method of form submission //
echo '
<!doctype html>
<html><head>
<meta charset="UTF-8">
<title>TEST Signup FORM</title>
</head><body>';
if (
isset($_POST['todo']) &&
($_POST['todo']=="post")
) {
$msg='';
$userid=sanitizeFromPost('userid');
if (strlen($userid)<5) {
$msg.='User ID should be 5 or more than 5 char length<br>';
}
if (empty($msg)) {
$password=sanitizeFromPost('password');
$password2=sanitizeFromPost('password2');
$email=sanitizeFromPost('email');
$name_last=sanitizeFromPost('name_last');
$name_first=sanitizeFromPost('name_first');
$query=mysql_query("
INSERT INTO member_tbl
(user_id,password,email,name_last,name_first)
VALUES
('$userid','$password','$email','$name_last','$name_first')
");
echo "Welcome, You have successfully submitted new member information<br><br>";
} else {
echo $msg.'<br><input type="button" value="Retry" onClick="history.go(-1)">';
}
}
echo '
</body></html>';
?>
Off Topic:
I'd also suggest kicking the HTML 5 nonsense to the curb since it's doing nothing but setting coding practices back a decade or more...
But of course, no one ever listens to poor Zathras no, he's quite mad they say. It is good that Zathras does not mind, has even grown to like it.
I'd also kick the mysql_ functions even harder, and switch at LEAST to mySQLi, or even better PDO. This isn't 2003.
Oh, also notice I got rid of the ok variable. If you add a error message, there are errors; as such all you have to do is check if $msg is empty. No need for the extra variable. I made my sanitize function return an empty string, so for the userid check all you have to do is check the length.
Reply With Quote
Originally Posted by CSU-Bill
Bookmarks