herghost Posted March 11, 2009 Share Posted March 11, 2009 Hi all, I have a multipage form that saves the input into sessions before being written to a mysql database in the final step. My question (I hope!) is quite simple! The first page of my form looks like this: <?php session_start();?> <?php include('include/header.php');?> <link href="stylesheet.css" rel="stylesheet" type="text/css"> <body class="twoColElsLt"> <div id="container"> <div id="leftblock1"> <h3>Please Enter Your Required Registration Details</h3> <h3><br> The registration process will take roughly 20 minutes to complete. Once this has been completed you will be taken to your member area which will display your current details and show how many times prospective employers have viewed your details. </h3> <p> </p> </div> <p><br /> <br /> <br /> Registration Step 1 - Personal Details</p> <p>You Are <span class="redtext">0%</span> Complete<br /> <br /> <br /> </p> <form action="registration_step2.php" method="post" class="twoColElsLt"> <table width="300" border="0" align="center" cellpadding="2" cellspacing="0"> <tr> <th bgcolor="#0000FF">First Name </th> <td bgcolor="#0000FF" class="tdback"><input name="firstname" type="text" class="redtext" id="firstname" /></td> </tr> <tr bgcolor="#0000FF"> <th bgcolor="#0000FF">Last Name </th> <td class="tdback"><input name="lastname" type="text" class="redtext" id="lastname" /></td> </tr> <tr bgcolor="#0000FF"> <th width="124" align="center" bgcolor="#0000FF">Desired User Name</th> <td class="tdback"><input name="login" type="text" class="redtext" id="login" /></td> </tr> <tr bgcolor="#0000FF"> <th bgcolor="#0000FF">Password</th> <td class="tdback"><input name="passwd" type="password" class="redtext" id="passwd" /></td> </tr> <tr bgcolor="#0000FF"> <th>Email Address </th> <td class="tdback"><input name="email" type="text" class="redtext" id="email" /></td> </tr> <tr> <td> </td> <td class="tdback"><input type="submit" name="Submit" value="Continue Registration" /></td> </tr> </table> <p> </p> </form> </div> </body> How would I include some form of security into this? Mainly I want to check that all the fields have been filled in and that the username and email have not been used before. Thanks Quote Link to comment https://forums.phpfreaks.com/topic/148963-form-security-question/ Share on other sites More sharing options...
kev wood Posted March 11, 2009 Share Posted March 11, 2009 you could use javascript to check if all the form fields are filled in before the form is submitted but to check if the names have already been used you will have to run a mysql query on the db. Quote Link to comment https://forums.phpfreaks.com/topic/148963-form-security-question/#findComment-782163 Share on other sites More sharing options...
herghost Posted March 11, 2009 Author Share Posted March 11, 2009 Thanks, I have got the validation sorted for checking the fields have been filled in using jave, however I have a bit of a question regarding checking the database. All my information is stored in sessions until the final page of the form, it is then entered into the database. However I want to check this on the 1st page so the user doesnt get all the way through the form then have to come back to page one. Could I put a button next to the email address etc which would check the database? would it be possible to store the information as a temp variable to check the database before the new one is inserted? And most importantly, where the hell do i start!! Quote Link to comment https://forums.phpfreaks.com/topic/148963-form-security-question/#findComment-782293 Share on other sites More sharing options...
redarrow Posted March 11, 2009 Share Posted March 11, 2009 This is a example how to no, if there a email in the database the same as, a user trying to enter to the database. <?php session_start(); //database connection. $sql="SELECT $email FROM $wat_ever WHERE id='{$_SESSION['id']}' "; if(myslq_num_rows($sql)==1){ $warning=" Sorry the email address is in use!"; }else{ $warning="Good news the email is ok!"; } echo $warning; ?> Quote Link to comment https://forums.phpfreaks.com/topic/148963-form-security-question/#findComment-782344 Share on other sites More sharing options...
Maq Posted March 11, 2009 Share Posted March 11, 2009 redarrow, mysql_num_rows() takes a resource not a string... AND you spelled mysql wrong when you called that function... $sql="SELECT $email FROM $wat_ever WHERE id='{$_SESSION['id']}' "; $result = mysql_query($sql) or die(mysql_error()); if(myslq_num_rows($result)==1){ Quote Link to comment https://forums.phpfreaks.com/topic/148963-form-security-question/#findComment-782351 Share on other sites More sharing options...
redarrow Posted March 11, 2009 Share Posted March 11, 2009 so sorry sir lol. <?php session_start(); //database connection. $sql="SELECT $email FROM $wat_ever WHERE id='{$_SESSION['id']}' "; $res=mysql_query($sql)or die(mysql_error()); if(mysql_num_rows($res)==1){ $warning=" Sorry the email address is in use!"; }else{ $warning="Good news the email is ok!"; } echo $warning; ?> Quote Link to comment https://forums.phpfreaks.com/topic/148963-form-security-question/#findComment-782364 Share on other sites More sharing options...
herghost Posted March 11, 2009 Author Share Posted March 11, 2009 Thanks! However, the member_id session is not defined until entering into database, so I can not use it here, what would be a good alternative? Quote Link to comment https://forums.phpfreaks.com/topic/148963-form-security-question/#findComment-782512 Share on other sites More sharing options...
redarrow Posted March 11, 2009 Share Posted March 11, 2009 so sorry now cheeks all the email address in the database. corrected <?php session_start(); //database connection. $sql="SELECT $email FROM $wat_ever"; $res=mysql_query($sql)or die(mysql_error()); if(mysql_num_rows($res)==1){ $warning=" Sorry the email address is in use!"; }else{ $warning="Good news the email is ok!"; } echo $warning; ?> Quote Link to comment https://forums.phpfreaks.com/topic/148963-form-security-question/#findComment-782514 Share on other sites More sharing options...
herghost Posted March 11, 2009 Author Share Posted March 11, 2009 Sorry mate, you have confused me! do you want me to delete the whole line? or just from WHERE? Quote Link to comment https://forums.phpfreaks.com/topic/148963-form-security-question/#findComment-782522 Share on other sites More sharing options...
redarrow Posted March 11, 2009 Share Posted March 11, 2009 i corrected the code.... Quote Link to comment https://forums.phpfreaks.com/topic/148963-form-security-question/#findComment-782526 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.