What improvements should I make?
Because the site is so form dependent I wrote a simple function to sanitize the user inputs and do a little formatting of the input data. This function also sanitizes the GET input from an activation email:
[php]function sanitizeAll() {
array_walk_recursive($_POST, 'trim');
array_walk_recursive($_GET, 'trim');
$data = array
(
"role" => FILTER_SANITIZE_STRING,
"code" => FILTER_SANITIZE_STRING,
"userName" => FILTER_SANITIZE_STRING,
"activationCode" => FILTER_SANITIZE_STRING,
"firstName" => FILTER_SANITIZE_STRING,
"lastName" => FILTER_SANITIZE_STRING,
"street" => FILTER_SANITIZE_STRING,
"city" => FILTER_SANITIZE_STRING,
"state" => FILTER_SANITIZE_STRING,
"zip" => FILTER_SANITIZE_NUMBER_INT,
"busName "=> FILTER_SANITIZE_STRING,
"busName" => FILTER_SANITIZE_MAGIC_QUOTES,
"email" => FILTER_SANITIZE_EMAIL,
"phone" => FILTER_SANITIZE_NUMBER_INT,
"fax" => FILTER_SANITIZE_NUMBER_INT,
"licenseNum" => FILTER_SANITIZE_NUMBER_INT,
"wsaddr" => FILTER_SANITIZE_URL,
);
if($_POST){
$var = filter_input_array(INPUT_POST, $data);
}else {
$var = filter_input_array(INPUT_GET, $data);
}
$phone = preg_replace("/[^0-9]/","",$var['phone']);
$var['phone'] = "(".substr($phone, 0, 3).") ".substr($phone, 3, 3)."-".substr($phone,6);
$fax = preg_replace("/[^0-9]/","",$var['fax']);
$var['fax'] = "(".substr($fax, 0, 3).") ".substr($fax, 3, 3)."-".substr($fax,6);
$parsed = parse_url($var['wsaddr']);
if (!isset($parsed['scheme'])) {
$url = $var['wsaddr'];
$var['wsaddr'] = "http://".$url."/";
}
return $var;[/php]
Then there is the registration page that first utilizes the above function, obviously there are other forms/pages that use this but for now this is the only one that is “complete”.
[php]include(‘pg_top.php’);
echo ‘
User Registration
’;echo ‘
’;
';
’;
$registerForm = ’
I am a buyer!
I am a auctioneer!
Username
Email
Password
Retype Password
';
if(isset($_POST['submitbtn'])){
$data = sanitizeAll();
if(!empty($data['role'])){
if(!empty($data['userName'])){
if(ctype_alnum($data['userName'])){
if (!preg_match('/\s/',$data['userName'])){
if(!empty($data['email'])){
if (filter_var($data['email'], FILTER_VALIDATE_EMAIL)) {
if(!preg_match('/(?=.{8,})(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).*/', $data['pswd'])){
if($data['pswd'] == $data['retypepswd']){
require('includes/db_connect.php');
$username = $data['userName'];
$sql = mysqli_query($conn, "SELECT count(*) FROM members WHERE username = '$username'");
$row = mysqli_fetch_row($sql);
if($row[0] == 0){
$salt = substr(md5(microtime()),rand(0,26),128);
$pepper = substr(md5(microtime()),rand(0,26),128);
$garlic = $salt.'!@#$%^&*()_+-'.$pepper;
$code = md5(str_shuffle($garlic));
$email = $data['email'];
$headers = 'From: <[email protected]>';
$headers .= "Reply-To: No Reply \r\n";
$headers .= "MIME-Version: 1.0\r\n";
$headers .= 'X-Mailer: PHP/' . phpversion();
$headers .= "Content-Type: text/html; charset=ISO-8859-1\r\n";
$subject = 'Your Auction Hunter Pro Registration';
$message = "<p>Thank you for registering at Auction Hunter Pro.</p>";
$message .= '<p>You must activate your account before you can login, please click <a href="http://auctionhunterpro.com/activate.php?activationCode='.$code.'&email='.$email.'">THIS LINK</a> to continue.</p>';
$message .= 'If you can not view HTML email you must enter the following mannually at http://auctionhunterpro.com/activate.php</p>';
$message .= '<p>Activation Code: '.$code.'</p>';
$message .= '<p>Email: '.$email.'</p>';
$message .= 'If you have any problems activating your account please feel free to contact us at [email protected]';
if(@mail($email, $subject, $message, $headers)){
$hash = password_hash($getpassword, PASSWORD_DEFAULT);
$role = $data['role'];
$sql = mysqli_query($conn, "INSERT INTO members
(id, username, email, password, active, code, role, setup_complete)
VALUES
('', '$username', '$email', '$hash', '0', '$code', '$role', '0')
");
$numrows = mysqli_affected_rows($conn);
if($numrows === 1){
echo '<div class="red t-center">Registration Sucessful!</div><div class="t-center">An email has been sent to the email address you supplied, <span class="red">you must activate your account</span> before logging in for the first time.</div>';
} else $errormsg = 'An error has occured please contain Customer Support.';
}else{ $errormsg = "There was an error sending your activation email."; }
}else { $errormsg = 'Sorry but this username is already in use.'; }
mysqli_close($conn);
}else { $errormsg = "Your passaords do not match."; }
}else { $errormsg = 'Your Password must contain 1 uppercase letter, 1 lowercase letter and 1 number.'; }
}else { $errormsg = 'This is not a valid email address.'; }
}else { $errormsg = "You must enter an email address"; }
}else { $errormsg = "Username may not contain spaces."; }
}else {$errormsg = "Usernames may only contain letters and numbers.";}
}else { $errormsg = "A username is required."; }
}else { $errormsg = 'You must chose a role, either buyer or auctioneer.'; }
}else { echo $registerForm; }
if(!empty($errormsg)){ echo '<div class="red">'.$errormsg.'</div>'.$registerForm ; }
echo ‘
include(‘pg_bot.php’);[/php]
The code functions as I intended but my fear it is not enough sanitation or I have other mistakes. So there it is, where am I making mistakes?
