How to Create Secure Registration Page in PHP/MySQL Part I

Submitted by GeePee on Saturday, May 30, 2015 - 00:10.

By secured we mean that we need to sanitize the data that is passed to our script in order to secure the registration of new account or user. There are three different types of connectivity in MySQL. They are: mysql = old MySQL function mysqli = improved MySQL function pdo = using prepared statement Mysql_connect is currently not supported in PHP version 5.5.0. So the option left are mysqli and pdo. In this tutorial, I will use mysql as there are still so many wanna be programmers who are using it. But we will sanitize it so it will still look secured. Let us prepare our database table. Database name: login Database table: member Using phpMyAdmin, create a database called "login". Now select the database that you have created. Click on the SQL tab and paste the following sql code.

CREATE TABLE `login`.`member` (
  `id` INT NOT NULL AUTO_INCREMENT PRIMARY KEY, 
  `username` VARCHAR(30) NOT NULL, 
  `password` CHAR(128) NOT NULL, 
  `email` VARCHAR(50) NOT NULL, 
  `salt` CHAR(128) NOT NULL
) ENGINE = InnoDB;

Create a Registration Form called "registration.html". For the meantime let's use table for our design.

<!<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Register</title>
</head>
 
<body>
<form name="register" action="register.php" method="post">
	<table width="510" border="0">
		<tr>
			<td colspan="2"><p><strong>Registration Form</strong></p></td>
		</tr>
		<tr>
			<td>Username:</td>
			<td><input type="text" name="username" maxlength="20" /></td>
		</tr>
		<tr>
			<td>Password:</td>
			<td><input type="password" name="password1" /></td>
		</tr>
		<tr>
			<td>Confirm Password:</td>
			<td><input type="password" name="password2" /></td>
		</tr>
		<tr>
			<td>Email:</td>
			<td><input type="text" name="email" id="email" /></td>
		</tr>
		<tr>
			<td>&nbsp;</td>
			<td><input type="submit" value="Register" /></td>
		</tr>
	</table>
</form>
</body>
</html>

Now create registration script called "register.php". First, let us receive the data from our registration form.

<?php
//retrieve our data from POST
$username = $_POST['username'];
$password1 = $_POST['password1'];
$password2 = $_POST['password2'];
$email = $_POST['email'];
 
if($password1 != $password2)
    header('Location: registration.html');
 
if(strlen($username) > 30)
    header('Location: registration.html');

Secure password using salt. This is called password hashing using salt. You can find more info about this at http://php.net/manual/en/faq.passwords.php

$hash = hash('sha256', $password1);
 
function createSalt()
{
    $text = md5(uniqid(rand(), true));
    return substr($text, 0, 3);
}
 
$salt = createSalt();
$password = hash('sha256', $salt . $hash);

Insert the value into "member" table.

$conn = mysql_connect('localhost', 'root', '');
mysql_select_db('login', $conn);
 
//sanitize username
$username = mysql_real_escape_string($username);
 
$query = "INSERT INTO member ( username, password, email, salt )
        VALUES ( '$username', '$password', '$email', '$salt' );";
mysql_query($query);
 
mysql_close();
 
header('Location: login.php');
?>

The important code here is the "mysql_real_escape_string". This will escape all character use for sql injection. So, only valid character will be used. As I've said earlier, we will use the obsolete or depreciated function called mysql_connect. We will be creating another tutorial on how to use mysqli_connect in our next tutorial.

Add new comment

406 views

How to Create Secure Registration Page in PHP/MySQL Part I

Tags

Add new comment