I have attached a changed file which takes away the compile-time bug. Here are some notes to help you. Some things are preferences, not requirements, but it will help you if you follow them anyway:
1) Don't use <? . Instead, use <?php to open PHP. The second is guaranteed to be available on PHP servers, while the first is not.
2) Always quote stuff as the array key. That is, $member['cool'] instead of $member[cool]. This protects against conflicts w/ constants.
3) Use CSS and classes to change styles instead of doing it inline. When you need to make a change, you will then only need to update 1 line of code instead of dozens (or hundreds).
4) Be cautious about using " and including variables in the middle. That is to say that:
PHP Code:
echo "My best friend $user_details['best_friend']['first_name'] made $45.00.";
will be harder to debug than:
PHP Code:
echo 'My best friend '.$user_details['best_friend']['first_name'].' made $45.00.';
5) Variables inside of strings can be a pain. Keep them outside (like the single-quote example above).
6) I rather doubt that your name="" variables (e.g. name='".$member['country']."') are correct. The name is not the value.
7) Tables are for data, not layouts. Visit places like
http://www.csszengarden.com/ for guidance on proper layout principles.
8) An IP address is not a unique identifier for a user. Verifying that as you are doing on line 313 is bad practice. For example, AOL users are given new IPs quite frequently -- even while browsing the same site. What is one user's IP on one page call may be another user's IP on another page visit while the original user's IP is totally different on their next page call.
9) Verify data to ensure that it contains only what you want and actually meets your requirements. For example,
PHP Code:
if(!$member['pass']){
$mes.="You must enter a username.<br />";
}
could evaluate true if the user's pass was all zeroes. OK. Not the best example there, but what you really want to do is ensure they have entered a password. Comparing it's string length would be better.
Here's a bit better example:
PHP Code:
if(mysql_num_rows(mysql_query("SELECT id FROM members WHERE name='$member[name]'"))){
Doesn't actualy match what you're looking for. This query means that "UserName" and "userName" are different.
10) Make sure that you have sanitized data. If, for example, the query above is presuming to use $member['name'] as submitted by the user, then you're wide open for SQL injection. Search this forum (especially the stickies) for tips here.
11) Using mysql_num_rows on the outside of mysql_query assumes that there won't be database query errors. Better to use something like this:
PHP Code:
$sanitized_member_name = str_replace('_','\_',str_replace('%','\%',mysql_real_escape_string($member['name'])));
//Alternatively, the member name could be sanitized with
$sanitized_member_name = preg_replace('/[^a-z0-9\-]/i','',$member['name']); //allows only letters, numbers, and a dash in the username
// "LIKE" here ensures case-insensitive matching.
$member_exists = mysql_query("SELECT id FROM members WHERE name LIKE '".$sanitized_member_name."'");
if(mysql_errno() == 0) {
if (mysql_num_rows($member_exists) > 0) {
//User exists
} else {
//User does not exist
}
} else {
//There was a database error.
echo 'Database error: '.mysql_error();
}
12) You're using plain md5 without a hash for saving passwords (and other stuff). Search this forum (and the net) for information about secure password storage. Specifically search for "hash seed php password".
13) Don't kill scripts on people. That's just rude. You took all that time to write error messaging for registration errors, but then did this:
PHP Code:
mysql_query($query) or die ('Error Updating The Database...Please Contact XXXX@YYYY.com');
Add error trapping there and show friendly messages. Your customers will appreciate it.
14) Don't tell customers to contact support. You give them an opportunity to go elsewhere. Instead, on failure email support with the details and have someone contact them. Of course, I mean if you have the ability to do that -- you may not have their information, but you can at least tell them that customer support has been contacted and ask if they'd like to be notified when someone can help them complete whatever process they were in.
15) Last thing: Be careful about spelling errors like "charecters". Plenty of code editors will check spelling for you and that will save you headaches for when you get the spelling correct and are trying to find why $characters isn't working as expected.
Well, that should get you started! Best wishes.
