How to Create Secure Registration Page in PHP/MySQL Part II

Submitted by GeePee on Saturday, May 30, 2015 - 23:14.

mysqli extension works differently compared to mysql extension. The 'i' stands for improved. Which means that it has some features that cannot be found in mysql extension. There are two approach in using mysqli extension. They are Object Oriented style and Procedural style. If you are migrating your old PHP file to mysqli extension, I prefer you use the procedural style. It's very easy to convert it to mysqli this way. Looking at the example in our previous tutorial. We will still use the same database called "login". We will just change some of the code under "registration.html" and "register.php".

Procedural style

registration2a.html

<!<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Register</title>
</head>
 
<body>
<form name="register" action="register2a.php" method="post">
	<table width="510" border="0">
		<tr>
			<td colspan="2"><p><strong>Registration Form</strong></p></td>
		</tr>
		<tr>
			<td>Username:</td>
			<td><input type="text" name="username" maxlength="20" /></td>
		</tr>
		<tr>
			<td>Password:</td>
			<td><input type="password" name="password1" /></td>
		</tr>
		<tr>
			<td>Confirm Password:</td>
			<td><input type="password" name="password2" /></td>
		</tr>
		<tr>
			<td>Email:</td>
			<td><input type="text" name="email" id="email" /></td>
		</tr>
		<tr>
			<td>&nbsp;</td>
			<td><input type="submit" value="Register" /></td>
		</tr>
	</table>
</form>
</body>
</html>

Note that we just change the value of action parameter under the form tag above. The previous value is register.php and now it was register2a.php Register2a.php

<?php
$username = $_POST['username'];
$password1 = $_POST['password1'];
$password2 = $_POST['password2'];
$email = $_POST['email'];
 
if($password1 != $password2)
    header('Location: registration.html');
 
if(strlen($username) > 30)
    header('Location: registration.html');
 
$hash = hash('sha256', $password1);
 
function createSalt()
{
    $text = md5(uniqid(rand(), true));
    return substr($text, 0, 3);
}
 
$salt = createSalt();
$password = hash('sha256', $salt . $hash);
 
$conn = mysqli_connect('localhost', 'root', '', 'login'); //we have added the database name called "login"
 
//mysql_select_db('login', $conn); //we remove this line
 
//sanitize username
$username = mysqli_real_escape_string($conn, $username);
 
$query = "INSERT INTO member ( username, password, email, salt ) VALUES 
		( '$username', '$password', '$email', '$salt' )";
 
//added $conn variable in order to connect to our database.
mysqli_query($conn, $query);
 
mysqli_close($conn);
 
header('Location: login.php');
?>

Object Oriented Style

registration2b.html Just change the line above from: <form name="register" action="register2a.php" method="post"> to: <form name="register" action="register2b.php" method="post"> register2b.php

<?php
$username = $_POST['username'];
$password1 = $_POST['password1'];
$password2 = $_POST['password2'];
$email = $_POST['email'];
 
if($password1 != $password2)
    header('Location: registration.html');
 
if(strlen($username) > 30)
    header('Location: registration.html');
 
$hash = hash('sha256', $password1);
 
function createSalt()
{
    $text = md5(uniqid(rand(), true));
    return substr($text, 0, 3);
}
 
$salt = createSalt();
$password = hash('sha256', $salt . $hash);
 
$mysqli = new mysqli('localhost', 'root', '', 'login'); //we change the mysqli_connect to "new mysqli"
 
//sanitize username
$username = $mysqli->real_escape_string($username);
 
$query = "INSERT INTO member ( username, password, email, salt ) VALUES 
		( '$username', '$password', '$email', '$salt' )";
 
//remove $conn variable in order to connect to our database using OOP.
$mysqli->query($query);
 
$mysqli->close();
 
header('Location: login.php');
?>

Now you see the difference? When it comes to features, there is no difference between Procedural and Object Oriented approach. Use the style which you think you are comfortable.