gabasc09

Ok that was what killed me. I asked help from a few friends on MSN and they haven't seen notices like this. The notice given was that variables were not properly set.

Might that be Google Docs?

<?php $set_username = 'user'; $set_password = 'pass'; if(isset($_POST['submit'])){ $username = $_POST['username']; $password = $_POST['password']; if(empty($username)){ $error['username'] = 1; } else { if($username == $set_username){ $error['username'] = 0; } else { $error['username'] = 2; } } if(empty($password)){ $error['password'] = 1; } else { if($password == $set_password){ $error['password'] = 0; } else { $error['password'] = 2; } } if($error['username'] == 0 && $error['password'] == 0){ session_start(); } } ?> <form method="post"> <table> <tr> <td>Username</td> <td><input type="text" name="username" value="<?php if($error['username'] == 0 && $error['password'] == 1 || $error['password'] == 2) {echo $username;} ?>" /></td> <td><?php if($error['username'] == 1){ echo 'Username is not entered';} elseif($error['username'] == 2) {echo 'Username is invalid';}?></td> </tr> <tr> <td>Password</td> <td><input type="password" name="password" /></td> <td><?php if($error['password'] == 1) { echo 'Password is not entered';} elseif($error['password'] == 2) { echo 'Password is invalid' ;} ?></td> </tr> <tr> <td></td> <td><input type="submit" name="submit" /> </tr> </table> </form> I am unsure why im getting PHP notices. And may i ask if my method is conventional and good? If not please state why :\

Still, it was somewhat a good answer. Cheers. I hope this guy isn't quitting coding over this issue. He should be racking his brains on fixing problems and not making the same mistake again. *Takes down notes: RFI, another script, security exploits, bla bla*

Anyone knows what hole it is? In any case, the situation MadTechie wrote about 'solved.. month later someone points .. problem.. 3 months after.. hijacked..' is simply humorous. I wonder how fun it is to create a script and keep exploiting-fixing it.

Your registration script doesn't check if passwords are identical and if email is actually a valid email address. You should consider putting the task of fixing it on your fix-it priority list

May i know to what extent is mysql_query slower than PDO. And may i ask what exactly PDO does and how does it differ from mysql_query. I tried re-reading this topic, but couldn't get the notion of PDO So will someone please elaborate on whatever is being discussed here. *thank you*