PHP Registration accepts SAME USERNAME and EMAIL in uppper and lower case

Codes here !

Moderators: egami, macek, gesf

Post Reply
Moenagy18
New php-forum User
New php-forum User
Posts: 1
Joined: Sat May 12, 2018 11:55 am

Sat May 12, 2018 12:09 pm

I have this problem ... A registration form ... that takes inputs and save it in MYSQL database.

The sign up process works ok, it's just that it accepts SAME USERNAME and EMAIL if they are written differently
example:

username: moonlight18

if I try to sign up with MoonLIGHT18 ... like upper case / OR upper lower case combo it will accept that user and save them to the database !!!

same issue happens with EMAIL as well. I can sign up with

moenagy@gmail.com AND with MoeNAGY@gmail.com

I want to instead say , "Username is already taken!" or "Email is already in use"

notice that if I try to sign up with EXACT username or email ... like, if I tried to sign up with moonlight18 from the example above it WILL SAY ... "Username is already taken" ,

the code I have going on my signup.php : .... WILL YOU PLEASE TELL ME HOW TO WORK THIS ?



<?php require('includes/config.php');

//if logged in redirect to members page
if( $user->is_logged_in() ){ header('Location: memberpage.php'); exit(); }

//if form has been submitted process it
if(isset($_POST['submit'])){

if (!isset($_POST['username'])) $error[] = "Please fill out all fields";
if (!isset($_POST['email'])) $error[] = "Please fill out all fields";
if (!isset($_POST['password'])) $error[] = "Please fill out all fields";

$username = $_POST['username'];

//very basic validation
if(!$user->isValidUsername($username)) {
$error[] = 'Usernames must be at least 3 Alphanumeric characters';
} else {
$stmt = $db->prepare('SELECT username FROM members WHERE username = :username');
$stmt->execute(array(':username' => $username));
$row = $stmt->fetch(PDO::FETCH_ASSOC);

if(!empty($row['username'])){
$error[] = 'Username provided is already in use.';
}

}

if(strlen($_POST['password']) < 3){
$error[] = 'Password is too short.';
}

if(strlen($_POST['passwordConfirm']) < 3){
$error[] = 'Confirm password is too short.';
}

if($_POST['password'] != $_POST['passwordConfirm']){
$error[] = 'Passwords do not match.';
}

//email validation
$email = htmlspecialchars_decode($_POST['email'], ENT_QUOTES);
if(!filter_var($email, FILTER_VALIDATE_EMAIL)){
$error[] = 'Please enter a valid email address';
} else {
$stmt = $db->prepare('SELECT email FROM members WHERE email = :email');
$stmt->execute(array(':email' => $email));
$row = $stmt->fetch(PDO::FETCH_ASSOC);

if(!empty($row['email'])){
$error[] = 'Email provided is already in use.';
}

}


//if no errors have been created carry on
if(!isset($error)){

//hash the password
$hashedpassword = $user->password_hash($_POST['password'], PASSWORD_BCRYPT);

//create the activasion code
$activasion = md5(uniqid(rand(),true));

try {

//insert into database with a prepared statement
$stmt = $db->prepare('INSERT INTO members (username,password,email,active) VALUES (:username, :password, :email, :active)');
$stmt->execute(array(
':username' => $username,
':password' => $hashedpassword,
':email' => $email,
':active' => 'Yes'
));
$id = $db->lastInsertId('memberID');

//send email
$to = $_POST['email'];
$subject = "Registration Confirmation";
$body = "<p>Thank you for registering at demo site.</p>
<p>To activate your account, please click on this link: <a href='".DIR."activate.php?x=$id&y=$activasion'>".DIR."activate.php?x=$id&y=$activasion</a></p>
<p>Regards Site Admin</p>";

$mail = new Mail();
$mail->setFrom(SITEEMAIL);
$mail->addAddress($to);
$mail->subject($subject);
$mail->body($body);
$mail->send();

//redirect to index page
header('Location: index.php?action=joined');
exit;

//else catch the exception and show the error.
} catch(PDOException $e) {
$error[] = $e->getMessage();
}

}

}

User avatar
hyper
php-forum Fan User
php-forum Fan User
Posts: 728
Joined: Mon Feb 22, 2016 5:52 pm

Sun May 13, 2018 12:22 am

This is deliberate behaviour, the letters 'A' and 'a' are not the same in computers as it needs to know if you want an upper case letter or lower case letter.

The easiest way is to use either strtoupper or strtolower to change the input; or you can use PDO or SQL to do it when you insert into the database or change your select statement to convert it to UPPER or LOWER.

Code: Select all

WHERE UPPER(username) = ?
Remembering to convert the input!

Post Reply