registration script...

[localhost]

I have two errors that can occur with the registration script, email not valid, and passwords do not match. However, unless I use the die(); command, it will insert it into the database anyway, although the die command hides the form and shows the error message by itself when I want it to show the entire form, just show an error message on top. Any ideas?

Here is my code:
[CODE]
<?php

/* ****** TABLE QUERY FOR THIS SCRIPT ****** */
/*

CREATE TABLE users(
id INT NOT NULL AUTO_INCREMENT PRIMARY KEY,
username VARCHAR(50) NOT NULL,
password VARCHAR(50) NOT NULL,
email VARCHAR(50) NOT NULL,
aim VARCHAR(20) NOT NULL,
msn VARCHAR(50) NOT NULL,
yim VARCHAR(50) NOT NULL,
website VARCHAR(100) NOT NULL,
location VARCHAR(75) NOT NULL,
user_level INT NOT NULL
);

*/

include('inc/connect.php');

if(isset($_POST['submit']) && !empty($_POST['username']) && !empty($_POST['password1']) && !empty($_POST['password2']) && !empty($_POST['email']))
{

$username = $_POST['username'];
$password1 = $_POST['password1'];
$password2 = $_POST['password2'];
$email = $_POST['email'];
$aim = $_POST['aim'];
$msn = $_POST['msn'];
$yim = $_POST['yim'];
$website = $_POST['website'];
$location = $_POST['location'];

if($password1!=$password2)
{
echo "Passwords do not match.";
die();
}

if(!eregi("[A-Z0-9._%-]+@[A-Z0-9.-]+\.[A-Z]{2,4}",$email))
{
echo "Invalid Email Address.";
die();
}

$securepass = base64_encode($password1);

$sql = "INSERT INTO users (`username`, `password`, `email`, `aim`, `msn`, `yim`, `website`, `location`, `user_level`) VALUES ('$username', '$securepass', '$email', '$aim', '$msn', '$yim', '$website', '$location', '1')";

$sqlr = mysql_query($sql) or die(mysql_error());

if($sqlr)
{
echo "<script>window.location=\"login.php\"</script>";
}

}

?>
<style type="text/css">
<!--
.style1 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-size: x-small;
}
-->
</style>


<form action="register.php" method="POST" class="style1">
*Username:
  <input type="text" name="username">
  <BR>
*Password:
<input type="password" name="password1">
<br>
*Confirm Password:
<input type="password" name="password2">
<br>
*Email Address:
<input type="text" name="email">
<Br>
<Br>
<br>
AIM:
<input type="text" name="aim">
<br>
MSN:
<input type="text" name="msn">
<br>
YIM:
<input type="text" name="yim">
<Br>
<Br>
Website:
<input type="text" name="website" value="http://">
<Br>
Location:
<input type="text" name="location">
<br>
<input type="submit" name="submit" value="Register">
</form>
[/CODE]

[pixy]

Here's what I usually do to validate my scripts...

$errors = array();
if (empty($_POST['whatever'])) {
    $errors[] = 'You didnt fill in a field';
}
else {
    $whatever = $_POST['whatever'];
}
if (empty($errors)) {
    // Do the query and inserting, and make sure they're no duplicate usernames, etc.
}
else {
    foreach ($errors as $msg) {
        echo '<li> '.$msg.'</li>';
    }
}

That way, if there are any errors at all, it tells the user what they are and lets them try again. That way it wont put them in the database.

[BillyBoB]

or u can just use the if statements with else attached as in:

[code]
<?php
if($pass!=$pass2)
{
  echo ("Passwords don't match!");
}else{
  if(!eregi("[A-Z0-9._%-]+@[A-Z0-9.-]+\.[A-Z]{2,4}",$email))
  {
      echo("Invaild email!");
  }else{
      //go on from here
  }
}
?>
[/code]