i also added in mysql_real_escape_string() in the registration and it gave me one error. see my registration code below
<?php
$name=$_POST['name'];
$user=$_POST['user'];
$email=$_POST['email'];
$country=$_POST['country'];
$passreal=$_POST['password2'];
$password=md5($_POST['password']);
$password2=md5($_POST['password2']);
$location=$_POST['location'];
$family=$_POST['family'];
$names="$name $family";
$age=$_POST['age'];
$gender=$_POST['gender'];
$relation=$_POST['relation'];
$agree=$_POST['agree'];
//check if username contains space
if(false !== strpos($user, ' '))
{ echo '<font color=brown>Sorry, the username should not contain any spaces.</font></br>';
echo"you can use the underscore (_) to separate</br> or the minus (-) sign.</br>";
echo"<center><a href=sinup.php> < < BACK </a></center>";
exit();
}
//check if username is greater than 25 character
if (strlen($user)>20)
{
echo "<font color=brown>Length of username is too long!</font></br>";
echo"it should not be longer than 20 characters<br>";
echo"<center><a href=sinup.php> < < BACK </a></center>";
exit();
}
//check if email is valid
function isEmail($email) {
return preg_match('/^[-0-9A-Z_\.]{1,50}@([-0-9A-Z_\.]+\.){1,50}([0-9A-Z]){2,4}$/i', $email);
}
$err = '';
if ( !isEmail($_POST['email']) ) $err .= '<font color=brown>Your Email address must be valid!<br/><a href=sinup.php> < < BACK </a> </font>';
if ($err){ echo $err;
exit();
}
//check if all datas where posted.
if(!$name||!$password||!$family||!$country||!$user||!$email||!$location||!$relation||!$password2||!$gender||!$age){
echo "<center><b><font color=blue size=>Fill all the required Fields.</font></b><br>";
echo "<font color=blue >Go back and complete<br><a href=sinup.php><< BACK </a></font><br></center>";
exit();
}
if($password!=$password2){
echo"<center><font color=brown>Password You gave does Not match</font></center>";
echo"<center><form action=sinup.php method=post><input type=submit value='OKEY'></form></center>";
exit();
}
if(!$agree){
echo"<font color=brown>you must agree the term of service to register</font>";
exit();
}
///connecting to databases
include"config.php";
$check=mysql_query("SELECT user FROM login WHERE user='$user'");
$rows=mysql_num_rows($check);
if($rows==0){
//$query="INSERT INTO login(name,family,male,female,user,email,country,password) VALUES('$name','$family','$male','$female','$user','$email','$country','$password')";
$query="INSERT INTO login SET name='$names',age='$age',location='$location',passreal='$passreal',relation='$relation',gender='$gender',user='$user',email='$email',country='$country',password='$password',date=CURDATE()";
$prove="INSERT INTO profile SET names='$names',ages='$age',locations='$location',passreal='$passreal',relations='$relation',genders='$gender',users='$user',emails='$email',countrys='$country',passwords='$password',online='offline',dates=CURDATE()";
$result=mysql_query($query,$dbcnx);
$result1=mysql_query($prove,$dbcnx);
if($result||$result1){
echo"You registered successfully";
}
?>
which shows like i escaped some inputs.