Registration System

[fullphaser]

hmm that doesn't quite seem to fix the problem, it's almost like it entirly blows off the mysql database. I don't know. here is a revised version of the full registration and table script, and ideas, I know it has to be something in the way that I am doing the query, oh it is based (I guess lightly now) off of Reper's tutorial code if that helps anyone

 <?php 
//register form for avant-is.com other uses will include roatery site with mysql access
//free script avaliable for anyone who uses both PHP enabled websites and MySQL databases
//please keep this header intact
error_reporting (e_all);  
if ($logged_in == 1) {
    die('You have already registered, '.$_session['username'].'.');
}
if (isset($_POST['submit'])) { //checks to see if the submit button has been pushed
include ('settings.php');
$date = date('m,d,y');
$username = $_POST['username'];
$email = $_POST['email'];
$password = $_POST['password'];
    if (empty($username) || empty($password) || empty($_POST['passwordcheck']) || empty($email)) {
        die('<div class="error">You did not enter a required field, please try <a href="register.php">again</a></div>');
        } 
    if ($password != $_POST['passwordcheck']) {
        die ('<div class="error">The passowrds that you have entered do not match,please try <a href="register.php">again</a></div>');
        }
    if (!preg_match("/.*@.*..*/", $email) | preg_match("/(<|>)/", $email)) {
        die('<div class="error">Invalid e-mail address.please try <a href="register.php">again</a></div>');
        }
    if (!eregi('^[[:alnum:]][a-z0-9_\.\-]*@[a-z0-9\.\-]+\.[a-z]{2,4}$', stripslashes(trim($email)))) {
        die('<div class="error">the pattern within the e-mail address that you have submitted does not conform with standard protocol, please either use another e-mail address or try <a href="register.php">again</a></div>');
        }
    if (eregi("\r",$email) || eregi("\n",$email)){
        die('<div class="error">The characters that you are using in your email adress are similar to hex code, and your e-mail address has been rejected, please use a different e-mail address or try <a href="register.php">again</a></div>');
        }
    if ($_POST['agree'] != 1) {
        die('<div class="error">you have not agreed to the registration contract, please try <a href="register.php">again</a></div>'); 
        }
    if (!get_magic_quotes_gpc()) {
        $username = addslashes($username);
        }
    $chkname = mysql_query("SELECT * FROM avantusers WHERE username = '$username'") or die(mysql_error());
    $chkemail = mysql_query("SELECT * FROM avantusers WHERE email = '$email'") or die(mysql_error());
        if (!(mysql_num_rows($chkname) == 1 || mysql_num_rows($chkemail) == 1)) {
        echo "Thank you $username ou are now registered an e-mail has been sent to your e-mail address so that you may activate your account,";
        $usermessage = "Thank you $username for registering with Avant Information Servies, with you registration we can provide you with many resources that you did not previously have avaliable. Please be sure to activate your account to help us ensure that you\'re e-mail is not only active, but also to help us limit the amount of bots which use this registration system please follow this link http://www.avant-is.com/index.php?page=activate&user=$username";
        $adminmessage = "A user, $username has just joined on $date.";
        $username = strip_tags($username);
        $password = strip_tags($password);
        $password = md5($password);
        if (!get_magic_quote_gpc()) {
        $password = addslashes($password);
        }
        mysql_query("INSERT INTO avantusers (id, date, username, password, email) VALUES ('', '$date', '$username', '$password', '$email')") or die(mysql_error());
        mail($email, 'avant-is.com registration', $usermessage);
        mail('admin@avant-is.com', 'Registration', $adminmessage);
        }
    else {
    die("there is already a $username or $email registered with this site"); 
    }
} 
//assuming they haven't actually registered
?>
<h1>Register with Avant Information Services</h1>
<form action="register.php" method="post">
<table id="register">
<tr><td><h3>username:</h3></td><td><input type="text" name="username" value=""/></td></tr>
<tr><td><h3>password:</h3></td><td><input type="password" name="password" value=""/></td></tr>
<tr><td><h3>re-type password:</h3></td><td><input type="password" name="passwordcheck" value=""/></td></tr>
<tr><td><h3>e-mail:</h3></td><td><input type="text" name="email" value=""/></td></tr>
</table>
<h1>Registration Contract</h1>
<h2>You must agree to all terms within this contract before signing up for Avant Informatoin Services</h2>
<p class="smallprint">Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Sed faucibus, tellus at rhoncus fermentum, nisi ligula vehicula diam, eu fermentum augue ligula eu tortor. Donec varius est in elit. Curabitur leo. Vestibulum ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia Curae; Vivamus at ante. Aenean tincidunt. Fusce sem ante, pretium ut, vehicula vitae, auctor a, nunc. Nullam vestibulum, lacus non hendrerit ornare, leo magna imperdiet enim, id cursus magna mi malesuada nunc. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Vivamus dictum tellus et odio. Vivamus vitae sem quis enim tincidunt dictum. Nullam hendrerit tincidunt lorem. Fusce ac leo vitae nibh dictum elementum. In justo. Cras posuere lectus eu est. Vestibulum ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia Curae; Mauris metus odio, porttitor eu, malesuada non, tempus et, sapien. Vivamus eget risus.</p> 
<p class="smallprint">Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. In hac habitasse platea dictumst. Phasellus vehicula ante congue nisl. Duis mauris velit, porttitor lacinia, ullamcorper id, rhoncus non, elit. Suspendisse tincidunt. Sed id turpis. Ut sodales porta tortor. Nullam lacinia augue aliquet libero. Aliquam dapibus dictum nisl. Nullam sit amet lacus. Donec leo ipsum, egestas aliquam, vulputate vitae, fermentum scelerisque, nunc. Fusce bibendum nulla a massa. Phasellus pharetra congue ligula. Maecenas sagittis, dui ut venenatis sodales, lectus ligula dictum diam, sit amet sodales mi dui sed metus.</p> 
<p class="smallprint">Sed luctus cursus erat. Nulla sagittis cursus tellus. Mauris bibendum. Nullam nibh sem, vestibulum a, bibendum sed, dictum pellentesque, justo. Maecenas ut nisi. Suspendisse metus erat, tempor id, interdum at, rhoncus eu, arcu. Sed quis velit. Pellentesque enim ante, lobortis sed, faucibus ut, sodales ut, erat. Nullam hendrerit iaculis lorem. Nulla arcu. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos hymenaeos. Aliquam volutpat odio non metus. Nam nisl arcu, venenatis ac, congue sed, ornare eget, augue. Suspendisse non nisi sit amet arcu fringilla ultricies. Suspendisse semper commodo leo. Ut adipiscing tempus elit. Integer facilisis, erat eget tristique lobortis, ligula quam sodales urna, et adipiscing metus massa ac risus. Mauris ac sem. Donec pharetra, sapien id vestibulum bibendum, massa nibh vulputate neque, ac consectetuer nibh magna nec dolor. Praesent turpis.</p> 
<p class="smallprint">Integer justo lacus, ullamcorper at, aliquet vitae, pretium pretium, turpis. Maecenas dignissim volutpat dolor. Maecenas fermentum. Donec non sem. Aenean nisl diam, sagittis at, dictum adipiscing, rhoncus sed, metus. Maecenas ut lectus. Fusce eget purus sed velit tincidunt pellentesque. Vivamus volutpat. Duis metus velit, viverra vitae, convallis quis, pellentesque euismod, turpis. Proin in felis eget purus tincidunt ornare. Morbi sit amet diam. Aliquam in orci.</p> 
<p class="smallprint">Curabitur nec nisi et pede gravida rhoncus. Suspendisse nonummy imperdiet tortor. Ut in pede a mauris tempus scelerisque. Suspendisse sagittis massa. Nunc nisl. Nam eros nisl, aliquet eu, ornare non, varius in, lorem. Proin rhoncus justo in dui. Donec massa. Phasellus in nunc. Sed ut nisl eget sem convallis dapibus. Sed lacinia eleifend dolor.</p> 
<p class="center"><input type="radio" name="agree" value="0" /> I do not agree with the Terms of Service     <input type="radio" name="agree" value="1" />I do agree with these terms of service</p>
<p class="center"><input type="submit" name="submit" value="submit" /></p>
</form> 

Mabye if I understood the mysql_num_rows() command better, I have looked it up on PHP.net and traveled google a few times, but it seems like I would have had this pinned by now

[fullphaser]

alright I have taken the time to debug things and it all comes out well, so now the login, logut, register and activation all work, but well except logout,

see example script

 <?php
unset($_SESSION['logged_In'], $_SESSION['username'], $_SESSION['padmin'], $_SESSION['admin'], $_SESSION['mod'], $_SESSION['last_login']);
setcookie("avant_logged_in","avant-is.com cookie",time()-60);
if(isset($_COOKIE['avant_mod'])){
setcookie("avant_mod","avant-is.com cookie", time()-60);}
if(isset($_COOKIE['avant_admin'])) {
setcookie("avant_admin","avant-is.com cookie", time()-60);}
if(isset($_COOKIE['avant_prime_admin'])) {
setcookie("avant_prime_admin","avant-is.com cookie", time()-60);
}
?>  

Now I think the cookies are getting unset (I think) but, in all reality, I am not sure, I have tried registering with different usernames and ussaly the reactions are a bit spotty these are the sessions and cookies sent by the login script if it is succesful

 else{
            $time = mysql_query("SELECT last_login FROM avantusers WHERE username = '$username'") or die(mysql_error());
            if(mysql_num_rows($time) > 0) {  
                while($row = mysql_fetch_array($time, MYSQL_ASSOC)) {
                    $_SESSION['last_login'] = $row['last_login'];
                    }
                }
            else {
                $_SESSION['last_login'] = "n/a";
                }
            $prime_admin_check = mysql_query("SELECT is_prime_admin FROM avantusers WHERE username = '$username'");
            while($row = mysql_fetch_array($prime_admin_check, MYSQL_ASSOC)){
                if($row['is_prime_admin'] == 0) {
                    $_SESSION['padmin'] = 1;
                    setcookie("avant_prime_admin","avant-is.com cookie",time()+60*60*3);
                    }
                else {
                    $_SESSION['padmin'] = 0;
                    }
                }
            $admin_check = mysql_query("SELECT is_admin FROM avantusers WHERE username = '$username'");
            while($row = mysql_fetch_array($admin_check, MYSQL_ASSOC)){
                if($row['is_admin'] == 0) {
                    $_SESSION['admin'] = 1;
                    setcookie("avant_admin","avant-is.com cookie",time()+60*60*3);
                    }
                else {
                    $_SESSION['admin'] = 0;
                    }
                }
            $mod_check = mysql_query("SELECT is_mod FROM avantusers WHERE username = '$username'");
            while($row = mysql_fetch_array($mod_check, MYSQL_ASSOC)){
                if($row['is_mod'] == 0) {
                    $_SESSION['mod'] = 1;
                    setcookie("avant_mod","avant-is.com cookie",time()+60*60*3);
                    }
                else {
                    $_SESSION['mod'] = 0;
                    }
                }
            mysql_query("UPDATE avantusers SET last_login = '$this_login'") or die(mysql_error());
            $_SESSION['username'] = $username;
            $_SESSION['logged_in'] = 1;
            setcookie("avant_logged_in","avant-is.com cookie",time()+60*60*6); 
            header("location: http://www.avant-is.com/");
            echo "<div id=\"login_box\">thank you for logging in ".$_SESSION['username']." if your browser doesn't automatically redierct you click <a href=\"./\" title=\"home page\">here</a></div>";
            } 
  

any thoughts or suggestions?

[4fingers]

Instead of using unset() on all the Session variables can you not just use session_destroy()

Also I don't see why you set the value in the cookie when your trying to delete it so intead try something like this:

 setcookie("avant_prime_admin","", "/", ".example.com", time()-60) 
  

That might not help but ill have a closer look later on.

[Nick Presta]

Yes, if you set your cookie to minus time (In the past), the cookie is destroyed/unset.