[PHP] Registering user account via Website

[MalTeN123]

I have been toying around with my own website lately, got some nice inputs from some of you guys for a php script that helped showing online peeps on the server, and now im unto the creating user system.

It actually works just great except for one thing. When the password is being insert into the account table, something is going wrong.

I'll post the whole thing in small pieces for you to get an understanding of whats going wrong

Part 1 is the form (nothing speciel here though)

<td height="22"><form action="loading.php?try=true" method="post">
<table width="900" border="0" align="center" cellpadding="0" cellspacing="0">
<tr>
<td width="66" height="28"><font size="1">Username:</font></td>
<td width="834"><font size="1">
<input type="text" name="username">
* </font></td>
</tr>
<tr>
<td height="28"><font size="1">Password:</font></td>
<td><font size="1">
<input type="password" name="password">
*</font></td>
</tr>
<tr>
<td height="28"><font size="1">Email:</font></td>
<td><font size="1">
<input type="text" name="email">
*</font></td>
</tr>
<tr>
<td height="28"> </td>
<td><input name="Reset" type="reset" id="Reset" value="Reset">
<input name="submit" type="submit" value="Register"></td>
</tr>
<tr>
<td height="28"> </td>
<td><font color="#999999" size="1">Fields where * is next to is required
to register.</font></td>
</tr>
</table>
</form>

Part 2 is the creating process (when the users have typed in their personal info)

<?php
 
 $conn = mysql_connect('localhost', 'username', 'password') or die(mysql_error());
mysql_select_db('realmd', $conn); // Selecting the Realmd database

//Setting the Expansion ($tbc) to 1 and getting the ip address from user 
$tbc = "1";
$ip = getenv('REMOTE_ADDR');
 

// is ?try=true in the url?
if (isset($_GET['try'])) {
 
    // Yes, the user has clicked on the submit button, check all fields
    if(empty($_POST['username']) OR 
   empty($_POST['password']) OR 
   empty($_POST['email']) ) {
 
    // At least one of the file is empty, display an error
    // Redirecting you to another page
    header("Refresh: 1; url=http://127.0.0.1/LegendaryLeague/fields_empty.php");
 
} else {
 
// User has filled it all in!
 
    // SQL save variables
    $username = mysql_real_escape_string($_POST['username']);
    $password = SHA1($_POST['password']);
    $email = mysql_real_escape_string($_POST['email']);
 
        $query = mysql_query("SELECT COUNT(id) FROM account 
   WHERE username = '" . $username . "' 
   OR email = '" . $email . "' ") or die(mysql_error());
 
 
        list($count) = mysql_fetch_row($query);
 
        if($count == 0) {
        
                    // Username and Email are free!
            mysql_query("INSERT INTO account
                    (`username`, `sha_pass_hash`, `email`, `expansion`, `last_ip`)
                    VALUES
                    ('" . $username . "', '" . $password . "', '" . $email . "', '" . $tbc . "', '" . $ip . "')
                    ") or die(mysql_error());
                    

        //Redirecting you to the success register page
            header("Refresh: 3; url=http://127.0.0.1/LegendaryLeague/success_register.php");

 
        } else {
 
            // Username or Email already taken
            // Redirecting you to the failed register page
            header("Refresh: 3; url=http://127.0.0.1/LegendaryLeague/failed_register.php");
 
        }
 
 
}
 
}

?>

The user is being create successfully, but when you try to login using WoW it says that either password or username have been spelled wrong, and thats not the case here.

I think its something with the encrypting in the database maybe?

Can anyone see the problem here?

Really hope you can help me on this one :blush:!!

EDIT: Okay I can see it have something to do with the SHA1 password encrypting. When I register my self under the password "ffffff" and I look it up in the database it got the encyption "506da6907f960f50cad09ca45512519f91515237", but if I make an echo with "ffffff" as SHA1 it turns out like this "c81019207890deb5cba8cda1de0dd6b1c229eeff " completely different.

Anyone knows where in this code the encryptions fails?

 

[Nortie]

Stop the double posting, if you didn't get help on the other section, just wait.

I've replied on your other post in the World of Warcraft Section:

[link]
http://forum.ragezone.com/f114/registering-user-account-via-website-php-coding-488114/

 

[Wh005h]

Obviously something happens to the string before hashing that changes it from the "fffff" hash to something else.
SHA-1 is slightly more secure than MD5 in response to the other post. The c8 hash is correct for the string.
1. Something is happening after insertion
2. Something is happening before hashing

That's about as much as I can say =/ I would at this point rewrite the script in segments to find my error.

 

[MalTeN123]

Stop the double posting, if you didn't get help on the other section, just wait.

I've replied on your other post in the World of Warcraft Section:

[link]
http://forum.ragezone.com/f114/registering-user-account-via-website-php-coding-488114/

Sorry for double posting. I just noticed that there was a development forum for coders, so I think I might would get more respond here

As you replied to me in the other thread, I will try to work with MD5 and see if that should bring me further to my goal

Obviously something happens to the string before hashing that changes it from the "fffff" hash to something else.
SHA-1 is slightly more secure than MD5 in response to the other post. The c8 hash is correct for the string.
1. Something is happening after insertion
2. Something is happening before hashing

That's about as much as I can say =/ I would at this point rewrite the script in segments to find my error.

Thanks for the response. I'll try to work a little with MD5 like Nortie replied to me in this post http://forum.ragezone.com/f114/registering-user-account-via-website-php-coding-488114/

The post will go on here, so do not reply on the other

EDIT: Now im not the best database developer, but I know some of it. But is there a way to change the field "sha_pass_hash" to MD5 since I think its made to SHA1 passwords, or does it matter at all?

I have changed this

	// SQL save variables
$password = SHA1($_POST['password']);

to

	// SQL save variables
$password = MD5($_POST['password']);

But I still get a different output from the echo and the output in the database with the same password.

 

[Wh005h]

Well if you're certain nothing is changing the input for the hash before hand then I would say that it must be mysql related. In fact, I can say that with a fairly large bit of certainty since process of elimination says so.

Also, I don't believe that you can freely change between md5 and sha-1 with the registration because the WoW server will likely only recognize one of the two (normally md5 for servers).

 

[MalTeN123]

Okay, I simply coulnd't find the reason why it didn't work, so I rewrote most of the code in a rough with some modifications, and now it works like a charm!

Thanks to those who helped !