Zoldos, are you JOKING with us??? LOL
You can NOT do an IF() clause on a PREPARE clause! ! !
Also, you check to see if the $username is empty AFTER you run a query based on it. Your code is all messed up. Lastly, you have no protection from code being placed into your forms. You need to add some code to filter out hacker crap out of the input fields. Here is a version of yours with some changes which should get you started. Not tested, just rewritten off the top of my tired mind…
// USING MySQLi...
// Check if form was posted ( Using the preferred way not using ISSET...
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
$username = filter_input(INPUT_POST, "username");
$password = filter_input(INPUT_POST, "password");
$password2 = filter_input(INPUT_POST, "password2");
$referral = filter_input(INPUT_POST, "referral");
$ip = filter_input(INPUT_POST, "ip");
$mail = filter_input(INPUT_POST, "'email2");
// Form is posted, fields are retrieved from form...
// This next section is okay but, may not work 100% (For another post...)
if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
$ip = $_SERVER['HTTP_CLIENT_IP'];
} elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
} else {
$ip = $_SERVER['REMOTE_ADDR'];
}
// Validate some of the user's inputs. You are not checking most of them... (Should add more!)
$error_message = "";
if ( empty($username) OR trim($username)=="") {
$error_message .= "<br>Username cannot be blank!";
}
if ( strlen($password) < 8 ) {
$error_message .= "<br>Password needs to be at least 8 characters!";
}
if ( $password != $password2 ) {
$error_message .= "<br>Passwords do not match!";
}
if ( empty($referral) ) {
$error_message .= "<br>Who referred you?";
}
if ( empty($mail) ) {
$error_message .= "<br>Where is your e-mail, did you follow the correct link?";
}
// If all these validations pass, then run queries to check usernames
if ( $error_message=="" ) {
$db->prepare('SELECT * FROM xf_user WHERE username = ?')) {
$stmt->bind_param('s', $username);
$stmt->execute();
$number_of_rows = $stmt->num_rows; // here if will fetch the count
if ( $number_of_rows > 0 ) {
$error_message .= "<br>Username already taken!";
}
$stmt->close();
$stmt = $db->prepare('SELECT * FROM xf_user WHERE username = ?')) {
$stmt->bind_param('s', $referral);
$stmt->execute();
$number_of_rows = $stmt->num_rows; // here if will fetch the count
if( $number_of_rows!=0) {
$error_message .= "<br>Referring username doesn't exist!";
}
$stmt->close();
// All validation is complete, check results. If errors, display them, if not send email...
if ( $error_message!="" ) {
// Display error(s) NOTE: error message will show ALL errors, not just the last one!
echo "<br><span class='error_msg'>" . $error_message . "</span><br>";
} else {
// All okay, send the email...
$date = date('m/d/Y');
$headers = "From: xxxx <xxxxxxxxxxxxx.net>";
$subject = "Access Request";
$message = "Submitted E-mail: $mail
Chosen Username: $username
Password: $password
IP: $ip
Referred By: $referral
Date requested: $date\n
Simply reply to this message being sure to quote the above info. Once received, I'll setup your account!\n
~z";
mail($mail, $subject, $message, $headers);
header('location: done.html');
}
}
}
This example is TOTALLY not tested. I just rewrote your logic and added a little of my own into it for you. The version will “concatenate” the error messages and place them when displayed into one error list. This means, if you leave out the email address or miss-match the passwords,etc, it will show you ALL of the errors, not just the last one. You can test that buy submitting the form with nothing entered into it.
It also is more in order better than your previous tries. Hope this helps! Good luck!
EDIT: Not sure if your email section where you create the message will work as-is. You might need to redo that section so it is better formatted.
But anyway, I’m putting it on the shelf for good this time. I clearly have not grasped PHP like I thought I was. 