Ik ben sinds vorige week bezig met PDO, Nu heb ik een registratie pagina gemaakt en wil ik graag vragen om tips, op en aanmerkingen op de code te leveren. Eventuele verbeteringen zijn welkom.
Vind het namelijk wat makkelijker als ik zie wat er veranderd is.
Alvast bedankt voor de tips!!
<?php
ini_set('display_errors', 'On');
error_reporting(E_ALL);
require_once 'db_config.php';
//Check e-mail function
function checkmail($mail)
{
$emailhost = explode("@", $mail);
$emailhost = $emailhost['1'];
$emailres = gethostbyname($emailhost);
if ($emailres != $emailhost && eregi("^[0-9a-z]([-_.~]?[0-9a-z])*@[0-9a-z]([-.]?[0-9a-z])*\\.[a-z]{2,4}$",$mail))
{
return true;
}
else
{
return false;
}
}
try
{
//Convert en secure the vars
$username = $_POST['username'];
$email = $_POST['email'];
$firstname = $_POST['firstname'];
$lastname = $_POST['lastname'];
$password = sha1($password);
$passworda = sha1($passworda);
$ip = $_SERVER['REMOTE_ADDR'];
$gender = $_POST['gender'];
$country = $_POST['country'];
$terms = $_POST['termsagree'];
$newsl = $_POST['newsletter'];
//Check if the request method is post
if($_SERVER['REQUEST_METHOD'] == 'POST')
{
//Check if the username field is empty
if(empty($username))
{
echo 'You have to enter a username in order to register.';
}
//Check if the password fields are empty
elseif(empty($password) OR empty($passworda))
{
echo 'You have to enter a password in order to register.';
}
//Check if the passwords matchs
elseif($password != $passworda)
{
echo 'Password does not match the password verification field.';
}
//Check if the user entered a e-mail address
elseif(empty($email))
{
echo 'You have to enter a valid email address in order to register.';
}
//Check if the user entered a e-mail address
elseif(!checkmail($email))
{
echo 'You have to enter a valid email address in order to register.';
}
//Check if there is a firstname
elseif(empty($firstname))
{
echo 'You have to enter a first name in order to register.';
}
//Check if there is a lastname
elseif(empty($lastname))
{
echo 'You have to enter a last name in order to register.';
}
//Check if the user agrees with our terms of service
elseif($terms != 'Yes')
{
echo 'You have to agree with our terms of service in order to register.';
}
//Check if the username is already in use.
$sQuery = 'SELECT username FROM users WHERE username > :username';
$oStmt = $db->prepare($sQuery);
$oStmt->bindParam(':username', $username, PDO::PARAM_STR);
$oStmt->execute();
$count = $oStmt->rowCount();
if ($count > 0)
{
echo 'The entered username is already in use by another account.';
}
//Check if the e-mail address is already in use.
$sQuery = 'SELECT email FROM users WHERE email > :email';
$oStmt = $db->prepare($sQuery);
$oStmt->bindParam(':email', $email, PDO::PARAM_STR);
$oStmt->execute();
$count = $oStmt->rowCount();
if ($count > 0)
{
echo 'The entered e-mail address is already in use by another account.';
}
//Check if the ip address is already in use.
$sQuery = 'SELECT ip FROM users WHERE ip > :ip';
$oStmt = $db->prepare($sQuery);
$oStmt->bindParam(':ip', $ip, PDO::PARAM_STR);
$oStmt->execute();
$count = $oStmt->rowCount();
if ($count > 0)
{
echo 'Your ip address is already in use by another account.';
}
//Checked everything, Lets generate a activation code
else
{
$actcode = rand(15);
//Prepair the sql insert
$sQuery = '
INSERT INTO users
(
username,
email,
password,
firstname,
lastname,
gender,
country,
newsletter,
ip
)
VALUES
(
:username,
:email,
:password,
:firstname,
:lastname,
:gender,
:country,
:newsletterr,
:ip
) ';
$oStmt = $db->prepare($sQuery);
$oStmt->bindParam(':username', $username, PDO::PARAM_STR);
$oStmt->bindParam(':email', $email, PDO::PARAM_STR);
$oStmt->bindParam(':password', $password, PDO::PARAM_STR);
$oStmt->bindParam(':firstname', $firstname, PDO::PARAM_STR);
$oStmt->bindParam(':lastname', $lastname, PDO::PARAM_STR);
$oStmt->bindParam(':gender', $gender, PDO::PARAM_STR);
$oStmt->bindParam(':country', $country, PDO::PARAM_STR);
$oStmt->bindParam(':newsletterr', $newsletterr, PDO::PARAM_STR);
$oStmt->bindParam(':ip', $ip, PDO::PARAM_STR);
$oStmt->execute();
$id = $db->lastInsertId();
if (!empty($id))
{
echo 'Registration succesfull.';
}
else
{
echo 'Registration failed.';
}
}
}
else
{
echo 'Registration form.';
}
}
catch(PDOException $e)
{
$sMsg = '<p>
Line Number: '.$e->getLine().'<br />
File Name: '.$e->getFile().'<br />
Error Message: '.$e->getMessage().'
</p>';
trigger_error($sMsg);
}
?>
<?php
//Convert en secure the vars
$username = $_POST['username'];
$email = $_POST['email'];
$firstname = $_POST['firstname'];
$lastname = $_POST['lastname'];
$password = sha1($password);
$passworda = sha1($passworda);
$ip = $_SERVER['REMOTE_ADDR'];
$gender = $_POST['gender'];
$country = $_POST['country'];
$terms = $_POST['termsagree'];
$newsl = $_POST['newsletter'];
?>
Deze regels zijn overbodig, je kunt verderop in je script gewoon de betreffende $_POST variabelen gebruiken. Bovendien zullen deze regels foutmeldingen opleveren als er geen formulier gepost is, de POST variabelen bestaan dan niet. De controle daarop doe je pas de regel daaronder, dus dat heeft hier geen invloed op.
SELECT username FROM users WHERE username > :username
Dat > teken mag gewoon een = teken zijn. Het is erg onlogisch om te kijken of de ene string groter is dan de ander. Dit geldt ook voor de overige select queries.
