0

So I have a lot of questions over this subject so what I will do is post the code that I am trying to work with so you can all get a better understanding of whats going on. I am not a professional php developer therefor there will be a lot of flawed or not efficient code. My first file is Conn.php this file will handle the connection to the database, I assume this file is done correctly.

<?php



class Conn {
    public static $dbhost = "localhost";
    public static $dbuser = "user name to database";
    public static $dbpass = "password to access database";
    public static $dbname = "database name";

}



?>

The next file MySQLDao.php this file will handle all my sql queries, not really sure if all this is done right.

<?php
class MySQLDao {
var $dbhost = null;
var $dbuser = null;
var $dbpass = null;
var $conn = null;
var $dbname = null;
var $result = null;

function __construct() {
$this->dbhost = Conn::$dbhost;
$this->dbuser = Conn::$dbuser;
$this->dbpass = Conn::$dbpass;
$this->dbname = Conn::$dbname;
}

public function openConnection() {
$this->conn = new mysqli($this->dbhost, $this->dbuser, $this->dbpass, $this->dbname);
if (mysqli_connect_errno())
echo new Exception("Could not establish connection with database");
}

public function getConnection() {
return $this->conn;
}

public function closeConnection() {
if ($this->conn != null)
$this->conn->close();
}

public function getUserDetails($email)
{
$returnValue = array();
$sql = "select * from users where user_email='" . $email . "'";

$result = $this->conn->query($sql);
if ($result != null && (mysqli_num_rows($result) >= 1)) {
$row = $result->fetch_array(MYSQLI_ASSOC);
if (!empty($row)) {
$returnValue = $row;
}
}
return $returnValue;
}

public function getUserDetailsWithPassword($email, $userPassword)
{
$returnValue = array();
$sql = "select id,user_email from users where user_email='" . $email .     "' and user_password='" .$userPassword . "'";

$result = $this->conn->query($sql);
if ($result != null && (mysqli_num_rows($result) >= 1)) {
$row = $result->fetch_array(MYSQLI_ASSOC);
if (!empty($row)) {
$returnValue = $row;
}
}
return $returnValue;
}

public function registerUser($email, $password)
{
$sql = "insert into users set user_email=?, user_password=?";
$statement = $this->conn->prepare($sql);

if (!$statement)
throw new Exception($statement->error);

$statement->bind_param("ss", $email, $password);
$returnValue = $statement->execute();

return $returnValue;
}

} 
?>

The next file that I have will handle business logic to store user registration details into a database table.

<?php 


require("Conn.php");
require("MySQLDao.php");

$email = htmlentities($_POST["email"]);
$password = htmlentities($_POST["password"]);

$returnValue = array();

if(empty($email) || empty($password))
{
$returnValue["status"] = "error";
$returnValue["message"] = "Missing required field";
echo json_encode($returnValue);
return;
}

$dao = new MySQLDao();
$dao->openConnection();
$userDetails = $dao->getUserDetails($email);

if(!empty($userDetails))
{
$returnValue["status"] = "error";
$returnValue["message"] = "User already exists";
echo json_encode($returnValue);
return;
}

$secure_password = md5($password);

$result = $dao->registerUser($email,$secure_password);

if($result)
{
$returnValue["status"] = "Success";
$returnValue["message"] = "User is registered";
echo json_encode($returnValue);
return;
}

$dao->closeConnection();

?>

The final file will handle business logic to check if user with provided user name and password exist in our database

<?php

require("Conn.php");
require("MySQLDao.php");
$email = htmlentities($_POST["email"]);
$password = htmlentities($_POST["password"]);
$returnValue = array();

if(empty($email) || empty($password))
{
$returnValue["status"] = "error";
$returnValue["message"] = "Missing required field";
echo json_encode($returnValue);
return;
}

$secure_password = md5($password);

$dao = new MySQLDao();
$dao->openConnection();
$userDetails = $dao->getUserDetailsWithPassword($email,$secure_password);

if(!empty($userDetails))
{
$returnValue["status"] = "Success";
$returnValue["message"] = "User is registered";
echo json_encode($returnValue);
} else {

$returnValue["status"] = "error";
$returnValue["message"] = "User is not found";
echo json_encode($returnValue);
}

$dao->closeConnection();

?>

To start off I am sorry for my poor code views here I'm not 100% up to speed on how this forum works and all it has to offer, with that out of the way here a my questions, one I feel like I should have another field in my database, like one that will make a random integer and assign it to a person upon registering, this will be the unique field, how would I implement something like that? The next this is, this is something that I have pieced together on the internet so are you can imagine its a little off from what I need it to do, how this is setup now from what I can see is that there is a singular registration page with a massive form and all the info is submitted together, but what i have is a multiple page registration system, one page will ask for your email, then the next will ask for your name and so on traveling through many pages. I want to know what I would have to do to this code to make it keep submitting that info to the same user in the database, then when the next user comes along it will put there info into there section on the database and no one else's.

Please if I am doing something wrong please tell me instead of disliking this post. I will do my best to fix what I am doing wrong.

  • 1
    Check out `password_hash()` and `password_verify()` . Passwords should not be saved in cleartext. Passwords are only verified with password_verify, never in a `where` clause the way one might think to do it. Even if hashed the right way, one does not compare in a `where`, otherwise you are subject to Timing Attacks. Here is a [mysqli](http://stackoverflow.com/a/33665819) version I wrote up, with a PDO link at the bottom for those on PDO – Drew Jul 21 '16 at 02:25
  • Can i ask you what Schema is? – Joe Kuzera Jul 21 '16 at 02:40
  • Just fancy database terminology for here is the structure of the database tables. Table rules. Perhaps some loaded sample data. – Drew Jul 21 '16 at 02:42
  • Is there a way to message directly because i have some questions if you dont mind – Joe Kuzera Jul 21 '16 at 02:46
  • Those with 20 plus rep can chat via the chat system built into SO. I dwell in the [Campaigns](http://chat.stackoverflow.com/rooms/95290) room. Otherwise you can email me at drewpierce747 gmail and perhaps we can chat. But about 1/2 of that `mysqli` reference or the PDO one is self-evident what to do if someone has `PHP` skills under their belt, and some `mysql` too. I can't really endure a 1 hour session again, each time, with everyone, like I did with the 50 odd comments under that mysqli post. That went on for a day or two. – Drew Jul 21 '16 at 02:51
  • ***You really shouldn't use [MD5 password hashes](http://security.stackexchange.com/questions/19906/is-md5-considered-insecure)*** and you really should use PHP's [built-in functions](http://jayblanchard.net/proper_password_hashing_with_PHP.html) to handle password security. Make sure you [don't escape passwords](http://stackoverflow.com/q/36628418/1011527) or use any other cleansing mechanism on them before hashing. Doing so *changes* the password and causes unnecessary additional coding. – Jay Blanchard Jul 22 '16 at 17:38

0 Answers0