My newbish PHP help

[rh4u]

<?php
//The Variables
$name = $_POST["name"];
$password = $_POST["password"];
$email - $_POST["email"];
$age = $_POST["age"];
$submit = $_POST["submit"];
 
//The IFs
if ($submit != "")
{
 
    if ($name == "")
    {
        die ("Whoops! You didn't enter a username. You need that if you want to login!");
 
    }
 
    if ($password == "")
    {
        die ("Whoops! You didn't enter a password. You need this to login to your account as well as security for your account!");
 
    }
 
    if ($email == "")
    {
        die ("Whoops! You didn't enter an email. You need this to receive news and updates for the usersystem, as well as to verify your identity.");
            }
 
    if ($age == "")
    {
        die ("Whoops! You didn't enter your age. We need this to verify you are old enough to register!");
            }
 
    echo "Heya, $name - Welcome to $site. The details you used to sign up are as follows:<br>
Name: $name<br>
Email: $email<br>
Age: $age<br>
<br>
If the details are incorrect, use the back button and try again. If they are correct, please continue to the installer.";
    exit;
}
 
// The HTML
echo "<form action=\"register2.php\" method=\"post\">
  Username: <input type=\"text\" name\"name\"><br>
  Password: <input type=\"text\" name\"password\"><br>
  Email: <input type=\"text\" name=\"email\"><br>
  Age: <input type=\"text\" name=\"age\"><br>
  <input type=\"submit\" name=\"submit\" value=\"Submit\">
  </form>";
 
?>

[MrCraig]

You should really clean input :S

function clean($tobecleaned)
{
$cleaned = strip_tags(addslashes(stripslashes(htmlspecialchars($tobecleaned))));
return $cleaned;
} 

then do

clean($_POST[variablename]); 

instead of

$_POST[variablename]; 

[Dentafrice,]

<?php
//The Variables
$name = $_POST["name"];
$password = $_POST["password"];
$email - $_POST["email"];
$age = $_POST["age"];
$submit = $_POST["submit"];
 
//The IFs
if ($submit != "")
{
 
    if ($name == "")
    {
        die ("Whoops! You didn't enter a username. You need that if you want to login!");
 
    }
 
    if ($password == "")
    {
        die ("Whoops! You didn't enter a password. You need this to login to your account as well as security for your account!");
 
    }
 
    if ($email == "")
    {
        die ("Whoops! You didn't enter an email. You need this to receive news and updates for the usersystem, as well as to verify your identity.");
            }
 
    if ($age == "")
    {
        die ("Whoops! You didn't enter your age. We need this to verify you are old enough to register!");
            }
 
    echo "Heya, $name - Welcome to $site. The details you used to sign up are as follows:<br>
Name: $name<br>
Email: $email<br>
Age: $age<br>
<br>
If the details are incorrect, use the back button and try again. If they are correct, please continue to the installer.";
    exit;
}
 
// The HTML
echo "<form action=\"register2.php\" method=\"post\">
  Username: <input type=\"text\" name\"name\"><br>
  Password: <input type=\"text\" name\"password\"><br>
  Email: <input type=\"text\" name=\"email\"><br>
  Age: <input type=\"text\" name=\"age\"><br>
  <input type=\"submit\" name=\"submit\" value=\"Submit\">
  </form>";
 
?>

Ewww, don't use die. Just do an echo, then an exit.

You should really clean input :S

function clean($tobecleaned)
{
$cleaned = strip_tags(addslashes(stripslashes(htmlspecialchars($tobecleaned))));
return $cleaned;
} 

then do

clean($_POST[variablename]); 

instead of

$_POST[variablename]; 

Better clean function:

<?php

function clean($string)
{

    $string = htmlspecialchars($string, ENT_QUOTES);

    if (get_magic_quotes_gpc())
    {

        $string = stripslashes($string);

    }

    $string = str_replace("\"", "", $string);
    $string = htmlentities($string);
    $string = mysql_real_escape_string($string);

    return $string;

}


?>

[MrCraig]

$string = str_replace("\"", "", $string);

is not just the same as stripslashes?

Lol, but use denta's is looks more complicated and probs better

[lolwut]

<?php

//Clean function, comment out if not wanted.

function clean($this){
$this = strip_tags($this);
$this = htmlspecialchars($this, ENT_QUOTES);
$this = mysql_real_escape_string($this);
return $this;
}

if(isset($_POST['submit'])){

//The form was sent, let's do some stuff!

$name = clean($_POST['name']);
$password = clean($_POST['password']);
$email = clean($_POST['email']);
$age = clean($_POST['age']);

   if (!isset($name))
    {
        echo "Whoops! You didn't enter a username. You need that if you want to login!";
        exit;
    }

    if (!isset($password))
    {
        echo "Whoops! You didn't enter a password. You need this to login to your account as well as security for your account!";
        exit;
    }

    if (!isset($email)
    {
        echo "Whoops! You didn't enter an email. You need this to receive news and updates for the usersystem, as well as to verify your identity.";
        exit;
    }

    if (!isset($age))
    {
        echo "Whoops! You didn't enter your age. We need this to verify you are old enough to register!";
        exit;
    }

    echo("Heya, $name - Welcome to $site. The details you used to sign up are as follows:<br>
    Name: $name<br />
    Email: $email<br />
    Age: $age<br />
    <br />
    If the details are incorrect, use the back button and try again. If they are correct, please continue to the installer.
    ");

}else{

//The form hasn't yet been sent! Display it.

  echo("<form action=\"register2.php\" method=\"post\">
    Username: <input type=\"text\" name\"name\"><br>
    Password: <input type=\"text\" name\"password\"><br>
    Email: <input type=\"text\" name=\"email\"><br>
    Age: <input type=\"text\" name=\"age\"><br>
    <input type=\"submit\" name=\"submit\" value=\"Submit\">
    </form>
  ");

}

die();

?>

Fixed everything, used a clean function seen as them lot are raving about it ^^

[Dentafrice,]

!isset($age)

Anytime you submit a post..

$age = $_POST["age"];

Thats set, you need to check to see if it is blank, not set.

[lolwut]

isset() is the same as blank?
PHP assumes if a variable is blank then it is not set.
I.e.

$this = "";
if(!isset($this)){ die('lolnosoz'); } 

Correct me if I'm wrong.

[Dentafrice,]

Nope:

<?php

$bla = $_GET["hey"];
if (!isset($bla))
{
    echo "Not set";
}
else
{
    echo "Word: $bla";
}

?>

if you visit filename.php without putting the get, it is unset.

If you visit filename.php?hey it is set, but it is blank So it doesn't check to see if it is blank.

[Beau]

Er, that code won't work. Unless I'm mistaken, mysql_real_escape_string requires a connection to the database in order to execute.

[Dentafrice,]

it does, and certainly he will use a DB