I am going to walk you through coding a simple user registration feature from the ground up.
Step 1
Putting together the database
The first step is to build the database and get it ready to start being populated by information from the registration script.
Database Fields
Table Name: users
- userID – varcher(8) – Primary Key – Auto Increment
- username – varcher(25)
- password – varcher(16)
- email – varcher(80)
Step 2
Setting up the registration form
Now that the database is all in place, we need to set up the form users will fill out in order to register for the website. This will be in simple HTML, of course you are welcome to pretty it up using CSS and images.
1
2
3
4
5
6
7
8
9
| <form method="post">
Username: <input type="text" name="username" /><br />
Password: <input type="password" name="pass1" /><br />
Verify Password: <input type="password" name="pass2" /><br />
Email: <input type="text" name="email" /><br />
<input type="submit" value="Register" name="register">
</form> |
Step 3
Error Checking the users information
Now the user is ready to enter their information into the form. It is extremely important that you always do error checking on user inputted values. You need to make sure the information is what you are expecting – For example, if they supply an email you want to make sure it’s in the correct format before allowing them to register.
When I’m error checking, I like to use an array to store each possible error they encounter. That way at the very end I can loop through and display each error to them with ease.
I can’t stress enough how important it is to use the mysql_real_escape_string() function on ALL variables before they are put in the database. This protects you from MySQL injections that can literally wipe clean your entire database. Why there are people in the world that would do that? Beats me.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
| <?php
//check if they submit the form
if (isset($_POST['register'])){
//get all the values from the form
$username = mysql_real_escape_string($_POST['username']);
$pass1 = mysql_real_escape_string($_POST['pass1']);
$pass2 = mysql_real_escape_string($_POST['pass2']);
$email = mysql_real_escape_string($_POST['email']);
// #### ERROR CHECK ####
//Create array to catch errors
$errors = array();
//make sure they didn't leave any blank
if ($username == "" || $pass1 == "" || $pass2 == "" || $email == "")
$errors[] = "You must fill out all fields";
//make sure the passwords match
if ($pass1 != $pass2)
$errors[] = "Your passwords don't match!";
//Make sure the email is valid
if(!eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$", $this->email))
$errors[] = "The supplied email address is not valid";
//If there are errors, display them. If not, put information in database
if (!empty($errors)){
//display errors using foreach loop
echo '<h2>Errors:</h2>';
echo '<ul>';
foreach ($errors as $error){
echo "<li>$error</li>";
}
echo '</ul><br><br>';
} else {
//There were no errors, put information in database
}
}
?> |
Step 4
Inserting their information into the database
Now all we need to do is insert their information in the database – assuming they didn’t get any errors. In order to do this you of course must have a connection to your database established. So make sure to include your external config file, or add the connection code.
When inserting the password into the database, we are going to use the function md5() which will encrypt their password. This is important because if someone hacked into your database, they would be unable to get the persons actual password and be presented with a random string of numbers and letters.
1
2
3
4
5
6
7
8
9
10
11
12
13
| <?php
//There were no errors, put information in database
$query = "INSERT INTO users (username, password, email)
VALUES ('$username', '".md5($password)."', '$email')";
$result = mysql_query($query)or die(mysql_error());
//give them a success message
echo "<font color='green'>Successfully Registered!</font><br><br>";
?> |
Conclusion
Your users are now ready to sign up for your website! Of course now all you’re missing is a script to allow them to log in (that tutorial will be coming very soon!).
Full Register Script
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
| <?php
//check if they submit the form
if (isset($_POST['register'])){
//get all the values from the form
$username = mysql_real_escape_string($_POST['username']);
$pass1 = mysql_real_escape_string($_POST['pass1']);
$pass2 = mysql_real_escape_string($_POST['pass2']);
$email = mysql_real_escape_string($_POST['email']);
// #### ERROR CHECK ####
//Create array to catch errors
$errors = array();
//make sure they didn't leave any blank
if ($username == "" || $pass1 == "" || $pass2 == "" || $email == "")
$errors[] = "You must fill out all fields";
//make sure the passwords match
if ($pass1 != $pass2)
$errors[] = "Your passwords don't match!";
//Make sure the email is valid
if(!eregi("^[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,3})$", $this->email))
$errors[] = "The supplied email address is not valid";
//If there are errors, display them. If not, put information in database
if (!empty($errors)){
//display errors using foreach loop
echo '<h2>Errors:</h2>';
echo '<ul>';
foreach ($errors as $error){
echo "<li>$error</li>";
}
echo '</ul><br><br>';
} else {
//There were no errors, put information in database
$query = "INSERT INTO users (username, password, email)
VALUES ('$username', '".md5($password)."', '$email')";
$result = mysql_query($query)or die(mysql_error());
//give them a success message
echo "<font color='green'>Successfully Registered!</font><br><br>";
}
}
?>
<form method="post">
Username: <input type="text" name="username" value="<?php echo $_POST['username']; ?>" /><br />
Password: <input type="password" name="pass1" /><br />
Verify Password: <input type="password" name="pass2" /><br />
Email: <input type="text" name="email" value="<?php echo $_POST['email']; ?>" /><br />
<input type="submit" value="Register" name="register">
</form> |
