Register Script
The register script registers the following information; username, password. It has basic anti-sql and xss injection protection. It also includes one of my personal favorite additions (the random text field). It's very customizable, and very easy to configure. I've posted various notes throughout the script to assist you further, as well as a configuration security check.
The script has no hidden exploits, or wholes that someone may use to hack in, or sql inject etc. The script should be 100% safe from basic exploits (sql and xss).
The script is one file (what ever you'd like to name it - probably register.php). The configuration is included at the top, so do not forgot to fill it in.
The script has not been tested, it was written in this RaGEZONE thread. I will test it for 100% functionality when I get a chance, but if you're having any problems (wrong coding) let me know and I'll surely fix it up for everyone ASAP.
Legend: Red = Recent changes from last edit.
Create the function v1.0 (done by Reim):
Code:
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
CREATE PROCEDURE [dbo].[createaccount]
@account VARCHAR(15),
@password VARCHAR(32)
AS
SET NOCOUNT ON
DECLARE @DateActivated AS CHAR(8)
IF NOT EXISTS (SELECT account FROM ACCOUNT_TBL WHERE account = @account) BEGIN
INSERT INTO ACCOUNT_TBL (account, [password], id_no2, isuse, member, realname)
VALUES (@account, @password, @password, 'T', 'A', 'F')
SET @DateActivated = CONVERT(CHAR(8), GETDATE()-1, 112 ) --Is the date today - 1
--UPDATE ACCOUNT_TBL_DETAIL SET BlockTime = @DateYesterday WHERE account = @userid
--INSERT INTO ACCOUNT_TBL_DETAIL (account, gamecode, tester, m_chLoginAuthority, regdate, BlockTime, EndTime, WebTime, isuse)
-- VALUES (@account, 'A000', '2', 'F', GETDATE(), '20990101', '20990101', '20050101', 'O')
INSERT INTO ACCOUNT_TBL_DETAIL (account, gamecode, tester, m_chLoginAuthority, regdate, BlockTime, EndTime, WebTime, isuse)
VALUES (@account, 'A000', '2', 'F', GETDATE(), @DateActivated, '20990101', '20050101', 'O')
END
The script v1.0:
Code:
<?php
#############################
##Copyright (c) TheJacob#####
##All Rights Reserved########
##thejacobpollack@gmail.com##
#############################
#############################
#############################
##Configuration##
$mssql_server = ""; //MSSQL name
$mssql_username = ""; //MSSQL username
$mssql_password = ""; //MSSQL password
$mssql_account_db = ""; //MSSQL account database name
$mssql_account_table = ""; //MSSQL account table name
$mssql_username_column = ""; //MSSQL username column in account table
$mssql_password_column = ""; //MSSQL password column in account table
$hash = ""; //Hash code
$random_text_text = "e=mc2"; //Random text they must enter to register
#############################
#############################
##Configuration Settings Check##
if (($mssql_server == "") || ($mssql_username == "") || ($mssql_password == "") || ($mssql_account_db == "") || ($mssql_account_table == "") || ($mssql_username_column == "") || ($mssql_password_column == "") || ($hash == "") || ($random_text_text == "")) {
die ("<strong>Please fill in all the configuration settings! For your own security and the functionality of the script, you cannot leave them blank.</strong>");
}
##Connect##
$mssql_connect = mssql_connect($mssql_server, $mssql_username, $mssql_password) or die ("<strong>Cannot connect to the MSSQL Database.</strong>");
$mssql_select = mssql_select_db($mssql_account_db) or die ("<strong>Cannot select the MSSQL Database.</strong>");
##Function##
function doesUsernameExist($username){
$exit = FALSE;
$result = @mssql_query("SELECT * FROM $mssql_account_table WHERE $mssql_username_column='$username'");
if (mssql_num_rows($result) != 0){
$exit = TRUE;
}
return $exit;
}
$pusername = $_POST['username']; //Post wsername
$ppassword = $_POST['password']; //Post password
$prpassword = $_POST['rpassword']; //Post re-enter password
$fpassword = md5($hash . $password); //Full/Final password
$random_text = $_POST['random_text']; //Random text
if (isset($_POST['submit']) == true) {
$username = preg_replace("/[^a-zA-Z0-9\-\_\!\$\#\@\^\&\*\(\)\^\+\ \.\?]/", "", $pusername);
$password = preg_replace("/[^a-zA-Z0-9\-\_\!\$\#\@\^\&\*\(\)\^\+\ \.\?]/", "", $ppassword);
if ((isset($_POST['submit']) == true) and (strlen($pusername) < 3) || (strlen($pusername) > 15)) {
echo "Your username must be between 3 and 15 characters in length.";
}
else if ((isset($_POST['submit']) == true) and ((strlen($ppassword) < 3) || (strlen($ppassword) > 15) || (strlen($prpassword) < 3) || (strlen($prpassword) > 15))) {
echo "The password must be between 3 and 15 characters in length.";
}
else if ((isset($_POST['submit']) == true) and ($ppassword != $prpassword)) {
echo "The passwords must be the same.";
}
else if ((isset($_POST['submit']) == true) and (($pusername == $ppassword) || ($pusername == $prpassword))) {
echo "The username and password cannot be the same.";
}
else if ((isset($_POST['submit']) == true) and ($random_text != $random_text_text)) {
echo "The random text must be filled in correctly. Please take another look at the random text.";
} else {
if ((isset($_POST['submit']) == true) and (!doesUsernameExist($username))) {
$stmt = mssql_init('createaccount', $mssql_connect);
mssql_bind($stmt, '@account', $username, SQLVARCHAR, false, false, 15);
mssql_bind($stmt, '@password', $fpassword, SQLVARCHAR, false, false, 36);
mssql_execute($stmt) or die ("<strong>Error occurred while executing the statement.</strong>");
mssql_free_statement($stmt);
echo "You've been successfully registered as <strong>" . $username . "</strong>!";
} else {
echo "The username already exists.";
}
}
}
?>
<form method ="post" action="#">
<table>
<tr>
<td><strong>Username</strong></td>
</tr>
<tr>
<td><input name="username" type="username"></td>
</tr>
<tr>
<td><strong>Password</strong></td>
</tr>
<tr>
<td><input name="password" type="password"></td>
</tr>
<tr>
<td><strong>Re-enter Password</strong></td>
</tr>
<tr>
<td><input name="rpassword" type="password"></td>
</tr>
<tr>
<td><strong>Please enter "<?php echo $random_text_text ?>" without the brackets below</strong></td>
</tr>
<tr>
<td><input name="random_text" type="text"></td>
</tr>
<tr>
<td><input name="submit" type="submit" value="Register"></td>
</tr>
</table>
</form>
If you have any suggestions, comments, or stuff you'd like me to add or fix. Post it here and I'll see what I can do.
Credits:
![Functional Register Script [v15] - Quality](http://ragezone.com/hyper728.png)
Originally Posted by DoGoXD
