Problems with captcha and variable email

Question

Problems with captcha and variable email

Navigation

#1 by (6 votes)

1

<?php     
  if(isset($_SERVER['REQUEST_METHOD']) AND $_SERVER['REQUEST_METHOD'] == 'POST'){

  $nome = $_POST['nome'];
  $sobrenome = $_POST['sobrenome'];
  $email = $_POST['email'];
  $senha = $_POST['senha'];
  $sexo = $_POST['sexo'];

  if($nome == ''){
  echo 'Qual é o seu nome?';
  }elseif(strlen($nome)<3){
   echo'Insira um nome existente';
  }elseif($sobrenome==''){
 echo 'Qual é o seu sobrenome';
  }elseif(strlen($sobrenome)<4){
    echo'Insira um sobrenome existente';
  }elseif($email==''){
  echo 'Insira seu email';
  }elseif(!preg_match("/^[az0-9_\.\-]+@[az0-9_\.\-}*{a-z0-9_\-]+\.[a-z]{2,4}$/i",$email)){   
   echo 'E-mail invalido tente outro';
  }elseif($senha==''){
  echo 'Você precisa ter uma senha';

    }else{

        include('../../sllapsocial/classes/DB.class.php');

        $verificar = DB::getConn()->prepare("SELECT 'id' FROM 'usuarios' WHERE 'email'=?");
        if($verificar->execute(array($email))){
            if($verificar->rowCount()>=0){
         echo 'Este e-mail ja existe';

     }elseif($senha=='' OR strlen($senha)<4){
        echo'Senha fraca Insira mais caracteres';
     }elseif(strtolower($captcha) <> strtolower($_SESSION["captchaCadastro"])){
         echo 'Codigo errado';
     }else{
         $Senha = sha1($senha);
         $nascimento = "$ano-$mes-$dia";
         $Inserir = DB::getConn()->prepare("INSERT INTO 'usuarios' SET 'email'=?, 'senha'=?, 'nome'=?, 'sobrenome'=?, 'sexo'=?, 'nascimento'=?, 'cadastro'=NOW()");

         if($Inserir->execute(array($email,$senha,$nome,$sobrenome,$sexo,$nascimento))){
        header('Location: ./');  
           }

        }

       }

    }

    }


  ?>

php

asked by anonymous 28.09.2014 / 08:23

1 answer

Generic Repository with SQL How to insert the ID in the bank since it is the first field of the table?

score 6 · Accepted Answer

I have given a refactor in your code, making a more linear logic to at least see if you can see better where you are having problems.

Either way, you're not paying attention to all the recommendations, and you're still blending the case, forgetting ; at the end of the lines, and a host of other issues. Already improved with $_POST , but it is better to pack everything you can at once before posting a new question, otherwise we will have thousands of them and you will hardly advance.

<?php
   require_once( '../../sllapsocial/classes/DB.class.php' );

   if( @$_SERVER['REQUEST_METHOD'] == 'POST' ) {
      $nome =      $_POST['nome'];
      $sobrenome = $_POST['sobrenome'];
      $email =     $_POST['email'];
      $senha =     $_POST['senha'];
      $sexo =      $_POST['sexo'];
      $ano =       $_POST['ano'];
      $mes =       $_POST['mes'];
      $dia =       $_POST['dia'];
      $captcha =   $_POST['captcha'];

      $erro = '';

      if( $nome == '' ) {
         $erro .= 'Qual é o seu nome?<br>';
      } elseif ( strlen( $nome ) < 2 ) {
         $erro .= 'Insira um nome existente<br>';
      }

      if( $sobrenome == '' ) {
         $erro .= 'Qual é o seu sobrenome<br>';
      } elseif( strlen( $sobrenome ) < 2 ) {
         $erro .='Insira um sobrenome existente<br>';
      }

      if( $email == '' ) {
         $erro .= 'Insira seu email';
      } elseif( !filter_var($email, FILTER_VALIDATE_EMAIL) ) {
         $erro .= 'E-mail invalido tente outro<br>';
      }

      if( $senha == ''  OR strlen( $senha ) < 4 ) {
         $erro .= 'Você precisa ter uma senha<br>';
      }

      $verificar = DB::getConn()->prepare( 'SELECT 'id' FROM 'usuarios' WHERE 'email'=?' );
      if( $verificar->execute( array( $email ) ) ) {
         if( $verificar->rowCount() > 0 ){
            $erro .= 'Este e-mail ja existe<br>';
         // } else {
            // Se quiser, tire os comments deste código para testar se chegou aqui
            // $erro .= 'Email livre. Pode remover esse else do código<br>';
         }
      } else {
         $erro .= 'Erro interno ao verificar o e-mail<br>';
      }

      if( strtolower( $captcha ) <> strtolower( $_SESSION["captchaCadastro"] ) ) {
         $erro .= 'Codigo errado<br>';
      }

      if( $erro === '' ) {
         $senha = sha1($senha);
         $nascimento = "$ano-$mes-$dia";
         $inserir = DB::getConn()->prepare( 'INSERT INTO 'usuarios' SET 'email'=?, 'senha'=?, 'nome'=?, 'sobrenome'=?, 'sexo'=?, 'nascimento'=?, 'cadastro'=NOW()' );
         if( $inserir->execute( array( $email, $senha, $nome, $sobrenome, $sexo, $nascimento ) ) ) {
            {
               header('Location: /');
            }
         }
      }
      die( $erro );
   }
?>

The code continues with other issues, such as SQL Injection vulnerability, but is more linear. It would give a lot of improvement, but in the current situation it's good that it's easier to understand than optimized.

I changed the way your application error messages appear, they accumulate in the $erro variable and are shown at the end, so you first resolve the syntax problems, and then the logic ones.

Something else, the way you restrict the size of your first and last name, will have a lot of brave Chinese who will not be able to use your system. And the email validation I replace with a filter_var , but the ideal one is to check only if you have an arroba and a dot on the right side of it, not to delete valid emails.