Search the Community

I need new pair of eyes to look at this and tell me what's wrong with it. All I am trying to do is have a simple form that submits data to database. It works without the "token". With the token code added, it won't let process. I even did var_dump and the session and the $_post code doesn't match. Here's the code. Btw, session_start() and the database connection are in the init.php file. <?php require_once 'init.php'; $token = mcrypt_create_iv(16, MCRYPT_DEV_URANDOM); $_SESSION['token'] = $token; if(isset($_POST['register'], $_POST['token'])) { if($_POST['token'] === $_SESSION['token']) { $email = trim($_POST['email']); $password = trim($_POST['password']); if(empty($email)) { $error = 'Email is required!'; } else if(empty($password)) { $error = 'Password is required!'; } else if(strlen($password) < 6) { $error = 'Password must be at least 6 characters long!'; } else { $findUser = $db->prepare("SELECT email FROM users WHERE email = :email"); $findUser->bindParam(':email', $email); $findUser->execute(); $resultFind = $findUser->fetchAll(PDO::FETCH_ASSOC); if(count($resultFind) > 0) { $error = 'The email already exists! Please try a different email!'; } else { //Hash the password as we do NOT want to store our passwords in plain text. $passwordHash = password_hash($passward, PASSWORD_BCRYPT, array("cost" => 12)); $insertUser = $db->prepare("INSERT INTO users(email, password) VALUES(:email, :password)"); $insertUser->bindParam(':email', $email); $insertUser->bindParam(':password', $passwordHash); $resultInsert = $insertUser->execute(); if($resultInsert == false) { $error = 'There was a problem creating your account. Please try again later!'; } else { $success = 'Your account has been created.'; unset($_SESSION['token']); } } } } else { $error = 'The tokens do not match!'; } } ?> <h1>Sign up</h1> <form action="" method="post"> <fieldset> <input type="email" name="email" value="<?php echo $email; ?>" placeholder="Email" /> </fieldset> <fieldset> <input type="password" name="password" placeholder="Password" /> </fieldset> <fieldset> <input type="hidden" name="token" value="<?php echo $token; ?>" /> <input type="submit" name="register" value="Sign up" /> </fieldset> </form>