registration form

Discussion in 'PHP' started by mario_arrendejo, Aug 9, 2009.

  1. #1
    Hi, im have a website, have a registration form, this is the code what process the registration form:

    <?php
    if(!defined('DATALIFEENGINE'))
    {
      die("Hacking attempt!");
    }
    
    require_once ENGINE_DIR.'/classes/parse.class.php';
    
    $parse = new ParseFilter();
    $parse->safe_mode = true;
    $stopregistration = FALSE;
    
    if (isset ($_REQUEST['doaction'])) $doaction = $_REQUEST['doaction']; else $doaction = "";
    $config['reg_group'] = intval($config['reg_group']) ? intval($config['reg_group']) : 4;
    
    function check_reg ($name, $email, $password1, $password2, $sec_code=1, $sec_code_session=1) {
    	global $lang, $db;
    	$stop = "";
    
        if ( $sec_code != $sec_code_session OR !$sec_code_session) $stop .= $lang['reg_err_19'];
    	if ($password1 != $password2) $stop .= $lang['reg_err_1'];
    	if (strlen($password1) < 6) $stop .= $lang['reg_err_2'];
    	if (strlen($name) > 20) $stop .= $lang['reg_err_3'];
    	if (preg_match("/[\||\'|\<|\>|\"|\!|\?|\$|\@|\/|\\\|\&\~\*\+]/",$name)) $stop .= $lang['reg_err_4'];
    	if ((!ereg('^[-!#$%&\'*+\\./0-9=?A-Z^_`a-z{|}~]+'. '@'.'[-!#$%&\'*+\\/0-9=?A-Z^_`a-z{|}~]+\.'.'[-!#$%&\'*+\\./0-9=?A-Z^_`a-z{|}~]+$', $email)) or (empty($email))) $stop .= $lang['reg_err_6'];
    	if ($name == "") $stop .= $lang['reg_err_7'];
    
    	if ($stop == "")
    	{
    		$replace_word = array ('e' => '[eå¸]', 'r' => '[rã]', 't' => '[tò]', 'y' => '[yó]','u' => '[uè]','i' => '[i1l!]','o' => '[oî0]','p' => '[pð]','a' => '[aà]','s' => '[s5]','w' => 'w','q' => 'q','d' => 'd','f' => 'f','g' => '[gä]','h' => '[hí]','j' => 'j','k' => '[kê]','l' => '[l1i!]','z' => 'z','x' => '[xõ%]','c' => '[cñ]','v' => '[vuè]','b' => '[bâü]','n' => '[nïë]','m' => '[mì]','é' => '[éèu]','ö' => 'ö','ó' => '[óy]','å' => '[åe¸]','í' => '[íh]','ã' => '[ãr]','ø' => '[øwù]','ù' => '[ùwø]','ç' => '[ç3ý]','õ' => '[õx%]','ú' => '[úü]','ô' => 'ô','û' => '(û|ü[i1l!]?)','â' => '[âb]','à' => '[àa]','ï' => '[ïn]','ð' => '[ðp]','î' => '[îo0]','ë' => '[ën]','ä' => 'ä','æ' => 'æ','ý' => '[ý3ç]','ÿ' => '[ÿ]','÷' => '[÷4]','ñ' => '[ñc]','ì' => '[ìm]','è' => '[èué]','ò' => '[òt]','ü' => '[üb]','á' => '[á6]','þ' => '(þ|[!1il][oî0])','¸' => '[¸åe]','1' => '[1il!]','2' => '2','3' => '[3çý]','4' => '[4÷]','5' => '[5s]','6' => '[6á]','7' => '7','8' => '8','9' => '9','0' => '[0îo]','_' => '_','#' => '#','%' => '[%x]','^' => '[^~]','(' => '[(]',')' => '[)]','=' => '=','.' => '[.]','-' => '-');
    		$name=strtolower($name);
    		$search_name=strtr($name, $replace_word);
    
    		$row = $db->super_query ("SELECT COUNT(*) as count FROM " . USERPREFIX . "_users WHERE email = '$email' OR LOWER(name) REGEXP '[[:<:]]{$search_name}[[:>:]]' OR name = '$name'");
    
            if ($row['count']) $stop .= $lang['reg_err_8'];
    	}
    
    return $stop;
    
    }
    
    
    $row = $db->super_query("SELECT COUNT(*) as count FROM " . USERPREFIX . "_users");
    
     if ($config['allow_registration'] != "yes") 
     { 
    
    	msgbox ($lang['all_info'], $lang['reg_err_9']); 
        $stopregistration = TRUE;
    
     } elseif ($config['max_users'] > 0 AND $row['count'] > $config['max_users']) { 
    
    	msgbox ($lang['all_info'], $lang['reg_err_10']); 
        $stopregistration = TRUE;
    
     }
    
    
    if (isset($_POST['submit_reg'])) {
    
    	if ($config['allow_sec_code'] == "yes") {
    		$sec_code = $_POST['sec_code'];
    		$sec_code_session = ($_SESSION['sec_code_session'] != '') ? $_SESSION['sec_code_session'] : false;
    	} else {
    		$sec_code = 1;
    		$sec_code_session = 1;
    	}
    
    	$password1 = $_POST['password1'];
    	$password2 = $_POST['password2'];
    	$name = $db->safesql($parse->process(htmlspecialchars(trim($_POST['name']))));
    	$email = $db->safesql($parse->process($_POST['email']));
    
    	$reg_error = check_reg ($name, $email, $password1, $password2, $sec_code, $sec_code_session);
    
    
    	if (!$reg_error) {
    
    		if ($config['registration_type']) {
    
    	         include_once ENGINE_DIR.'/classes/mail.class.php';
    	         $mail = new dle_mail ($config);
    
    			 $row = $db->super_query("SELECT template FROM " . PREFIX . "_email where name='reg_mail' LIMIT 0,1");
    
    			 $row['template'] = stripslashes($row['template']);
    
    			 $idlink = rawurlencode(base64_encode($name."||".$email."||".md5($password1)."||".md5($name.$email.$config['key'])));
    
    			 $row['template'] = str_replace("{%username%}",$name, $row['template']);
    			 $row['template'] = str_replace("{%validationlink%}",$config['http_home_url']."index.php?do=register&doaction=validating&id=".$idlink, $row['template']);
    			 $row['template'] = str_replace("{%password%}", $password1, $row['template']);
    
                 $mail->send ($email, $lang['reg_subj'], $row['template']);
    
                 if ($mail->send_error) msgbox ($lang['all_info'], $mail->smtp_msg);
    	         else msgbox ($lang['reg_vhead'], $lang['reg_vtext']);
    
    			 $_SESSION['sec_code_session'] = false;
    
     			 $stopregistration = TRUE;
    
    		} else {
    
    			$doaction = "validating";
    			$_REQUEST['id'] = rawurlencode(base64_encode($name."||".$email."||".md5($password1)."||".md5($name.$email.$config['key'])));
    		}
    
    	} else {msgbox ($lang['reg_err_11'], $reg_error);}
    
    }
    
    
    
    if ($doaction != "validating" AND !$stopregistration) {
    
    	$tpl->load_template('registration.tpl');
    
            $tpl->set('[registration]',"");
            $tpl->set('[/registration]',"");
    		$tpl->set_block("'\\[validation\\](.*?)\\[/validation\\]'si","");
    		$path = parse_url($config['http_home_url']);
    
    	if ($config['allow_sec_code'] == "yes") {
            $tpl->set('[sec_code]',"");
            $tpl->set('[/sec_code]',"");
    		$tpl->set('{reg_code}',"<span id=\"dle-captcha\"><img src=\"".$path['path']."engine/modules/antibot.php\" alt=\"{$lang['sec_image']}\" border=\"0\" /><br /><a onclick=\"reload(); return false;\" href=\"#\">{$lang['reload_code']}</a></span>");
    	} else {
            $tpl->set('{reg_code}',"");
    		$tpl->set_block("'\\[sec_code\\](.*?)\\[/sec_code\\]'si","");
    	}
    
    
    $tpl->copy_template = "<form  method=\"post\" name=\"registration\" id=\"registration\" action=\"".$config['http_home_url']."index.php?do=register\">\n".$tpl->copy_template."
    <input name=\"submit_reg\" type=\"hidden\" id=\"submit_reg\" value=\"submit_reg\" />
    </form>";
    
    $tpl->copy_template .= <<<HTML
    <script language='JavaScript' type="text/javascript">
    function reload () {
    
    	var rndval = new Date().getTime(); 
    
    	document.getElementById('dle-captcha').innerHTML = '<img src="{$path['path']}engine/modules/antibot.php?rndval=' + rndval + '" border="0" width="120" height="50"><br /><a onclick="reload(); return false;" href="#">{$lang['reload_code']}</a>';
    
    };
    </script>
    HTML;
    
    $tpl->compile('content');
    $tpl->clear();
    
    }
    
    if (isset($_POST['submit_val'])) {
    
    	$fullname = $db->safesql($parse->process($_POST['fullname']));
    	$land = $db->safesql($parse->process($_POST['land']));
    	$icq = $db->safesql($parse->process($_POST['icq']));
    	$info = $db->safesql($parse->BB_Parse($parse->process($_POST['info']), false));
    
        $image = $_FILES['image']['tmp_name'];
        $image_name = $_FILES['image']['name'];
    	$image_size = $_FILES['image']['size'];
        $image_name  = str_replace(" ", "_", $image_name);
    	$img_name_arr = explode(".",$image_name);
    	$type         = end($img_name_arr);
    
    	$user_arr = explode ("||", base64_decode(rawurldecode($_POST['id'])));
    	$user = trim($db->safesql($user_arr[0]));
    	$pass = md5($user_arr[2]);
    
    	$db->query("SELECT * FROM " . USERPREFIX . "_users where name = '$user' AND password='$pass'");
    
    	if (!$db->num_rows()) $stop .= "Access Denied"; else $row = $db->get_row();
    
    	$db->free();
    
    	if (is_uploaded_file($image) AND !$stop) {
    
    		if ($image_size < 100000) {
    
    			$allowed_extensions = array("jpg", "png", "jpe", "jpeg", "gif");
    
    				if ((in_array($type, $allowed_extensions) or in_array(strtolower($type), $allowed_extensions)) and $image_name) {
    
    				include_once ENGINE_DIR.'/inc/makethumb.php';
    
    				$res = @move_uploaded_file($image, ROOT_DIR."/uploads/fotos/".$row['user_id'].".".$type);
    
    					if ($res) {
    
    						$thumb=new thumbnail(ROOT_DIR."/uploads/fotos/".$row['user_id'].".".$type);
    						$thumb->size_auto($user_group[$config['reg_group']]['max_foto']);	
    						$thumb->jpeg_quality($config['jpeg_quality']);
    						$thumb->save(ROOT_DIR."/uploads/fotos/foto_".$row['user_id'].".".$type);
    
    						@unlink (ROOT_DIR."/uploads/fotos/".$row['user_id'].".".$type);
    						$foto_name = "foto_".$row['user_id'].".".$type;
    
    						$db->query("UPDATE " . USERPREFIX . "_users set foto='$foto_name' where name='$user'");
    
    					} else $stop = $lang['reg_err_12'];
    				} else $stop = $lang['reg_err_13'];
    		} else $stop = $lang['news_err_16'];
    	}
    
    		if (strlen($info) > 500) $stop .= $lang['reg_err_14'];
    		if (strlen($fullname) > 100) $stop .= $lang['reg_err_15'];
    		if (strlen($land) > 100) $stop .= $lang['reg_err_16'];
    		if (strlen($icq) > 20) $stop .= $lang['reg_err_17'];
    
    	if ($stop){ msgbox ($lang['reg_err_18'], $stop); }
    	else {
    
    	$xfieldsaction = "init";
    	$xfieldsadd = true;
    	include(ENGINE_DIR.'/inc/userfields.php');
    	$filecontents = array ();
    
        if (!empty($postedxfields)) {
          foreach ($postedxfields as $xfielddataname => $xfielddatavalue) {
            if (!$xfielddatavalue) { continue;}
    
    		$xfielddatavalue = $db->safesql($parse->BB_Parse($parse->process($xfielddatavalue), false));
    
            $xfielddataname = $db->safesql($xfielddataname);
    
            $xfielddataname = str_replace("|", "&#124;", $xfielddataname);
            $xfielddatavalue = str_replace("|", "&#124;", $xfielddatavalue);
    		$filecontents[] = "$xfielddataname|$xfielddatavalue";
          }
    
          $filecontents = implode("||", $filecontents);
    	} else $filecontents = '';
    
    		$db->query("UPDATE " . USERPREFIX . "_users set fullname='$fullname', info='$info', land='$land', icq='$icq', xfields='$filecontents' where name='$user'");
    
    		msgbox ($lang['reg_ok'], $lang['reg_ok_1']);
    
    		$stopregistration = TRUE;
    	}
    }
    
    
    if ( ($doaction == "validating") AND (!$stopregistration) AND (!$_POST['submit_val']) ) {
    
    	$user_arr = explode ("||", base64_decode(rawurldecode($_REQUEST['id'])));
    
    	$regpassword = md5($user_arr[2]);
    	$name = trim($db->safesql(htmlspecialchars($parse->process($user_arr[0]))));
    	$email = trim($db->safesql($parse->process($user_arr[1])));
    
    	if (md5($name.$email.$config['key']) != $user_arr[3]) die ('ID not valid!');
    
    	$reg_error = check_reg($name, $email, $regpassword, $regpassword);
    
    	if ($reg_error != "") { 
    		msgbox ($lang['reg_err_11'], $reg_error); 
    		$stopregistration = TRUE; 
    	} else {
    
    	if (($_REQUEST['step'] != 2) AND $config['registration_type']) {
    		$stopregistration = TRUE;
    		$lang['confirm_ok'] = str_replace ('{email}', $email, $lang['confirm_ok']);
    		$lang['confirm_ok'] = str_replace ('{login}', $name, $lang['confirm_ok']);
    		msgbox ($lang['all_info'], $lang['confirm_ok']. "<br /><br /><a href=\"".$config['http_home_url']."index.php?do=register&doaction=validating&step=2&id=".rawurlencode($_REQUEST['id'])."\">".$lang['reg_next']."</a>"); 
    	} else {
    
        $add_time = time()+($config['date_adjust']*60);
    	$_IP = $db->safesql($_SERVER['REMOTE_ADDR']);
    	if (intval($config['reg_group']) < 3) $config['reg_group'] = 4;
    
        $db->query("INSERT INTO " . USERPREFIX . "_users (name, password, email, reg_date, lastdate, user_group, info, signature, favorites, xfields, logged_ip) VALUES ('$name', '$regpassword', '$email', '$add_time', '$add_time', '".$config['reg_group']."', '', '', '', '', '".$_IP."')");
    
                 set_cookie ("dle_name", $name, 365);
                 set_cookie ("dle_password", $user_arr[2], 365);
    
                 @session_register('dle_name');
                 @session_register('dle_password');
    
                 $_SESSION['dle_name']        = $name;
                 $_SESSION['dle_password']    = $user_arr[2];
    
    
    	}
    
      }
    
    }
    
    if ($doaction == "validating" AND !$stopregistration) {
    
    	$tpl->load_template('registration.tpl');
    
            $tpl->set('[validation]',"");
            $tpl->set('[/validation]',"");
    		$tpl->set_block("'\\[registration\\].*?\\[/registration\\]'si","");
    
    		  $xfieldsaction = "list";
    		  $xfieldsadd = true;
    		  include(ENGINE_DIR.'/inc/userfields.php');
              $tpl->set('{xfields}',$output);
    
    
    $tpl->copy_template = "<form  method=\"post\" name=\"registration\" enctype=\"multipart/form-data\" action=\"".$PHP_SELF."\">\n".$tpl->copy_template."
    <input name=\"submit_val\" type=\"hidden\" id=\"submit_val\" value=\"submit_val\">
    <input name=\"do\" type=\"hidden\" id=\"do\" value=\"register\">
    <input name=\"doaction\" type=\"hidden\" id=\"doaction\" value=\"validating\">
    <input name=\"id\" type=\"hidden\" id=\"id\" value=\"{$_REQUEST['id']}\">
    </form>";
    
    	$tpl->compile('content');
    	$tpl->clear();
    }
    
    ?>
    PHP:
    The deal is, my server can deliver messages to yahoo accounts, so i want the user cant put a yahoo mail, if he put a yahoo mail the system show a error. HOw i can do that? i only know a little of php, please help me, thanks
     
    mario_arrendejo, Aug 9, 2009 IP