Registering system takes wrong infos from wrong locations

Question

I have this code.

PHP

<?php
 ob_start();
 session_start();
 if( isset($_SESSION['user'])!="" ){
  header("Location: home.php");
 }
 include_once 'db.php';

 $error = false;

 if ( isset($_POST['btn-signup']) ) {

  // clean user inputs to prevent sql injections
  $name = trim($_POST['name']);
  $name = strip_tags($name);
  $name = htmlspecialchars($name);

  $email = trim($_POST['email']);
  $email = strip_tags($email);
  $email = htmlspecialchars($email);

  $pass = trim($_POST['pass']);
  $pass = strip_tags($pass);
  $pass = htmlspecialchars($pass);

  $Nume = trim($_POST['Nume']);
  $Nume = strip_tags($Nume);
  $Nume = htmlspecialchars($Nume);

  $Prenume = trim($_POST['Prenume']);
  $Prenume = strip_tags($Prenume);
  $Prenume = htmlspecialchars($Prenume);

  $NumePrenume = trim($_POST['NumePrenume']);
  $NumePrenume = strip_tags($NumePrenume);
  $NumePrenume = htmlspecialchars($NumePrenume);

  $CNP = trim($_POST['CNP']);
  $CNP = strip_tags($CNP);
  $CNP = htmlspecialchars($CNP);

    $NumarTelefon = trim($_POST['NumarTelefon']);
  $NumarTelefon = strip_tags($NumarTelefon);
  $NumarTelefon = htmlspecialchars($NumarTelefon);

    $ContBancar = trim($_POST['ContBancar']);
  $ContBancar = strip_tags($ContBancar);
  $ContBancar = htmlspecialchars($ContBancar);

    $Poza = trim($_POST['Poza']);
  $Poza = strip_tags($Poza);
  $Poza = htmlspecialchars($Poza);

    $Locatie = trim($_POST['Locatie']);
  $Locatie = strip_tags($Locatie);
  $Locatie = htmlspecialchars($Locatie);

    $NumarPunctaj = trim($_POST['NumarPunctaj']);
  $NumarPunctaj = strip_tags($NumarPunctaj);
  $NumarPunctaj = htmlspecialchars($NumarPunctaj);

    $Referal = trim($_POST['Referal']);
  $Referal = strip_tags($Referal);
  $Referal = htmlspecialchars($Referal);

    $Varsta = trim($_POST['Varsta']);
  $Varsta = strip_tags($Varsta);
  $Varsta = htmlspecialchars($Varsta);

    $IP = trim($_POST['IP']);
  $IP = strip_tags($IP);
  $IP = htmlspecialchars($IP);

    $Cont = trim($_POST['Cont']);
  $Cont = strip_tags($Cont);
  $Cont = htmlspecialchars($Cont);


  // basic name validation
  if (empty($name)) {
   $error = true;
   $nameError = "Please enter your full name.";
  } else if (strlen($name) < 3) {
   $error = true;
   $nameError = "Name must have atleat 3 characters.";
  } else if (!preg_match("/^[a-zA-Z ]+$/",$name)) {
   $error = true;
   $nameError = "Name must contain alphabets and space.";
  }

  //basic email validation
  if ( !filter_var($email,FILTER_VALIDATE_EMAIL) ) {
   $error = true;
   $emailError = "Please enter valid email address.";
  } else {
   // check email exist or not
   $query = "SELECT userEmail FROM users WHERE userEmail='$email'";
   $result = mysql_query($query);
   $count = mysql_num_rows($result);
   if($count!=0){
    $error = true;
    $emailError = "Provided Email is already in use.";
   }
  }


  // password validation
  if (empty($pass)){
   $error = true;
   $passError = "Please enter password.";
  } else if(strlen($pass) < 6) {
   $error = true;
   $passError = "Password must have atleast 6 characters.";
  }

  // password encrypt using SHA256();
  $password = hash('sha256', $pass);

  // if there's no error, continue to signup
  if( !$error ) {

   $query = "INSERT INTO users(userName,userEmail,userPass, Nume, Prenume, NumePrenume, CNP, NumarTelefon, ContBancar, Poza, Locatie, NumarPunctaj, Referal, IP, Cont) VALUES('$name','$email','$password','$Nume','$Prenume','$NumePrenume','$CNP','$NumarTelefon','$ContBancar','$Poza','$Locatie','$NumarPunctaj','$Referal','$IP','$Cont')";
   $res = mysql_query($query);

   if ($res) {
    $errTyp = "success";
    $errMSG = "Successfully registered, you may login now";
    unset($name);
    unset($email);
    unset($pass);
    unset($Nume);
    unset($Prenume);
    unset($NumePrenume);
    unset($CNP);
    unset($NumarTelefon);
    unset($ContBancar);
    unset($Poza);
    unset($Locatie);
    unset($NumarPunctaj);
    unset($Referal);
    unset($Varsta); 
    unset($IP);
    unset($Cont);   
   } else {
    $errTyp = "danger";
    $errMSG = "Something went wrong, try again later..."; 
   } 

  }


 }
?>

HTML

  <div class="form-group">
             <div class="input-group">
                <span class="input-group-addon"><span class="glyphicon glyphicon-user"></span></span>
             <input type="text" name="name" class="form-control" placeholder="Nickname" maxlength="50" value="<?php echo $name ?>" />
                </div>
                <span class="text-danger"><?php echo $nameError; ?></span>
            </div>

                        <div class="form-group">
             <div class="input-group">
                <span class="input-group-addon"><span class="glyphicon glyphicon-user"></span></span>
             <input type="text" name="name" class="form-control" placeholder="Nume" maxlength="50" value="<?php echo $Nume ?>" />
                </div>
                <span class="text-danger"><?php echo $nameError; ?></span>
            </div>

                        <div class="form-group">
             <div class="input-group">
                <span class="input-group-addon"><span class="glyphicon glyphicon-user"></span></span>
             <input type="text" name="name" class="form-control" placeholder="Prenume" maxlength="50" value="<?php echo $Prenume ?>" />
                </div>
                <span class="text-danger"><?php echo $nameError; ?></span>
            </div>

                                    <div class="form-group">
             <div class="input-group">
                <span class="input-group-addon"><span class="glyphicon glyphicon-user"></span></span>
             <input type="text" name="name" class="form-control" placeholder="NumePrenume" maxlength="50" value="<?php echo $NumePrenume ?>" />
                </div>
                <span class="text-danger"><?php echo $nameError; ?></span>
            </div>

            <div class="form-group">
             <div class="input-group">
                <span class="input-group-addon"><span class="glyphicon glyphicon-user"></span></span>
             <input type="text" name="name" class="form-control" placeholder="CNP" maxlength="50" value="<?php echo $CNP ?>" />
                </div>
                <span class="text-danger"><?php echo $CNPERROR; ?></span>
            </div>

            <div class="form-group">
             <div class="input-group">
                <span class="input-group-addon"><span class="glyphicon glyphicon-user"></span></span>
             <input type="text" name="name" class="form-control" placeholder="NumarTelefon" maxlength="50" value="<?php echo $NumarTelefon ?>" />
                </div>
                <span class="text-danger"><?php echo $nameError; ?></span>
            </div>

            <div class="form-group">
             <div class="input-group">
                <span class="input-group-addon"><span class="glyphicon glyphicon-user"></span></span>
             <input type="text" name="name" class="form-control" placeholder="ContBancar" maxlength="50" value="<?php echo $ContBancar ?>" />
                </div>
                <span class="text-danger"><?php echo $nameError; ?></span>
            </div>

            <div class="form-group">
             <div class="input-group">
                <span class="input-group-addon"><span class="glyphicon glyphicon-user"></span></span>
             <input type="text" name="name" class="form-control" placeholder="Poza" maxlength="50" value="<?php echo $Poza ?>" />
                </div>
                <span class="text-danger"><?php echo $nameError; ?></span>
            </div>

            <div class="form-group">
             <div class="input-group">
                <span class="input-group-addon"><span class="glyphicon glyphicon-user"></span></span>
             <input type="text" name="name" class="form-control" placeholder="Locatie" maxlength="50" value="<?php echo $Locatie ?>" />
                </div>
                <span class="text-danger"><?php echo $nameError; ?></span>
            </div>

            <div class="form-group">
             <div class="input-group">
                <span class="input-group-addon"><span class="glyphicon glyphicon-user"></span></span>
             <input type="text" name="name" class="form-control" placeholder="NumarPunctaj" maxlength="50" value="<?php echo $NumarPunctaj ?>" />
                </div>
                <span class="text-danger"><?php echo $nameError; ?></span>
            </div>

            <div class="form-group">
             <div class="input-group">
                <span class="input-group-addon"><span class="glyphicon glyphicon-user"></span></span>
             <input type="text" name="name" class="form-control" placeholder="Referal" maxlength="50" value="<?php echo $Referal ?>" />
                </div>
                <span class="text-danger"><?php echo $nameError; ?></span>
            </div>

            <div class="form-group">
             <div class="input-group">
                <span class="input-group-addon"><span class="glyphicon glyphicon-user"></span></span>
             <input type="text" name="name" class="form-control" placeholder="Varsta" maxlength="50" value="<?php echo $Varsta ?>" />
                </div>
                <span class="text-danger"><?php echo $nameError; ?></span>
            </div>

            <div class="form-group">
             <div class="input-group">
                <span class="input-group-addon"><span class="glyphicon glyphicon-user"></span></span>
             <input type="text" name="name" class="form-control" placeholder="IP" maxlength="50" value="<?php echo $IP ?>" />
                </div>
                <span class="text-danger"><?php echo $nameError; ?></span>
            </div>

            <div class="form-group">
             <div class="input-group">
                <span class="input-group-addon"><span class="glyphicon glyphicon-user"></span></span>
             <input type="text" name="name" class="form-control" placeholder="Cont" maxlength="50" value="<?php echo     $Cont ?>" />
                </div>
                <span class="text-danger"><?php echo $nameError; ?></span>
            </div>

            <div class="form-group">
             <div class="input-group">
                <span class="input-group-addon"><span class="glyphicon glyphicon-envelope"></span></span>
             <input type="email" name="email" class="form-control" placeholder="Enter Your Email" maxlength="40" value="<?php echo $email ?>" />
                </div>
                <span class="text-danger"><?php echo $emailError; ?></span>
            </div>

            <div class="form-group">
             <div class="input-group">
                <span class="input-group-addon"><span class="glyphicon glyphicon-lock"></span></span>
             <input type="password" name="pass" class="form-control" placeholder="Enter Password" maxlength="15" />
                </div>
                <span class="text-danger"><?php echo $passError; ?></span>
            </div>

But, when I register the new account, this happens:

1) "Cont" section gets registered into Nickname section.
2) Sections after Nume won't get updated into the database. Sections shows blank.

This is the tutorial I followed:

http://www.codingcage.com/2015/01/user-registration-and-login-script-using-php-mysql.html

***You shouldn't use [SHA1 password hashes](https://konklone.com/post/why-google-is-hurrying-the-web-to-kill-sha-1)*** or ***[MD5 password hashes](http://security.stackexchange.com/questions/19906/is-md5-considered-insecure)*** and you really should use PHP's [built-in functions](http://jayblanchard.net/proper_password_hashing_with_PHP.html) to handle password security. Make sure you [don't escape passwords](http://stackoverflow.com/q/36628418/1011527) or use any other cleansing mechanism on them before hashing. Doing so *changes* the password and causes unnecessary additional coding. — Jay Blanchard, Feb 06 '17 at 22:06
***Please [stop using `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php).*** [These extensions](http://php.net/manual/en/migration70.removed-exts-sapis.php) have been removed in PHP 7. Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [PDO](http://php.net/manual/en/pdo.prepared-statements.php) and [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and consider using PDO, [it's really pretty easy](http://jayblanchard.net/demystifying_php_pdo.html). — Jay Blanchard, Feb 06 '17 at 22:07
[Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)***. Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! — Jay Blanchard, Feb 06 '17 at 22:07
When you POST some vars, it uses `name` property of inputs. In all cases, your `name` property have "name" as value ... It won't work — ceadreak, Feb 06 '17 at 22:08
`if( isset($_SESSION['user'])!="" )` I have lost count as to how many times I've seen this syntax; it should be obliterated from the Internet. It's a false positive and needs to be set in two separate conditions. — Funk Forty Niner, Feb 06 '17 at 22:08
@JayBlanchard i made this register system based on a tutorial :( — , Feb 06 '17 at 22:11
btw, where are your `
` tags? and input for `$_POST['btn-signup']`? How do we know that isn't also failing? — Funk Forty Niner, Feb 06 '17 at 22:13
@Fred-ii- http://www.codingcage.com/2015/01/user-registration-and-login-script-using-php-mysql.html — , Feb 06 '17 at 22:15
You didn't follow that tutorial to a "T". They're using different name attributes for the inputs; you probably copy/pasted the first input you changed and forgot to name them differently. But their `if( isset($_SESSION['user'])!="" )` is definitely wrong and wasn't your fault; it was theirs. It's just a bad tutorial and I've seen it before. — Funk Forty Niner, Feb 06 '17 at 22:16
@Fred-ii- you told me before that I can be hacked. But now, with this tutorial? (I create the accounts, no one has acces to register) — , Feb 06 '17 at 22:24
It's a terrible tutorial and it should be eliminated from the Internet. — Funk Forty Niner, Feb 06 '17 at 22:26
*"I don't know why. I tried to follow some tutorials given by Fred ii"* - Huh? when and what did I give you that? I wouldn't have given you that tutorial link; never and I have stricken that from your question. — Funk Forty Niner, Feb 06 '17 at 22:33
@Fred-ii- u sent me to PDo statmens, and another good tutorials. Not to which I used. — , Feb 06 '17 at 22:38
exactly, the safe ones which you should have used; so why did you not use those along with password_hash()? is what I don't understand. If they were too complicated, then you should take more time to understand them. I say this because nobody here wants to see your db/site get hacked. As the expression goes: [*"an ounce of prevention is worth a pound of cure”*](https://www.ag.ndsu.edu/news/columns/beeftalk/beeftalk-an-ounce-of-prevention-is-worth-a-pound-of-cure/). ;-) — Funk Forty Niner, Feb 06 '17 at 22:45

Jay Blanchard · Accepted Answer · 2017-02-06T22:12:03.717

2

All of your inputs have the same name:

 name="name"

Each input should have a unique name which can then be identified in the $_POST array.

You have another problem, the following syntax is not correct:

if( isset($_SESSION['user'])!="" ){

Tests on this must be performed separately:

if( isset($_SESSION['user']) && $_SESSION['user'] != "" ){

Reading from left to right, "if session user is set and session user is not blank, then perform the following".

edited Feb 06 '17 at 22:12

answered Feb 06 '17 at 22:08

Jay Blanchard

34,243
16
77
119

1

Alternativley, this [solution](http://stackoverflow.com/questions/7880619/multiple-inputs-with-same-name-through-post-in-php) should work – Roshan Bhumbra Feb 06 '17 at 22:11
1

Sure, but that would be painfully complex for a new PHP developer @RoshanBhumbra and isn't recommended. – Jay Blanchard Feb 06 '17 at 22:12
I guess it depends on the circumstances, different names is probably better in this case. – Roshan Bhumbra Feb 06 '17 at 22:15
Shall I add && $_SESSION['user'] != "" ){ on every $_session ? and changing user with what its neccesary ? – Feb 06 '17 at 22:23
You do not need to do that. – Jay Blanchard Feb 06 '17 at 22:43

Registering system takes wrong infos from wrong locations

1 Answers1