register.php

   1 <?php
   2 $page_name = 'Registration';
   3 $require_login = false;
   4 require 'config.php';
   5 require 'top.inc.php';
   6 require 'extfuncs.inc.php';
   7 require 'encryption.inc.php';
   8
   9 if ( isset($_GET['regkey']) ) {
  10         $result = mysql_query('SELECT COUNT(*) FROM `users`
  11                         WHERE MD5(CONCAT(`name`, `user`)) = \''.mysql_real_escape_string($_GET['regkey']).'\'');
  12         if ( mysql_result($result, 0) ) {
  13                 mysql_query('UPDATE `users` SET `level` = '.INACTIVE_USER.'
  14                                 WHERE `level` = '.PENDING_EMAIL.'
  15                                 AND MD5(CONCAT(`name`, `user`)) = \''.mysql_real_escape_string($_GET['regkey']).'\'');
  16                 stop('<p>Your username has been successfully registered with an account level of '.INACTIVE_USER.".</p>\n",
  17                                 '<p><a href="login">Login</a> and post on the unconfirmed account board to complete your registration, ',
  18                                 "or the account will be deleted automatically after 2 days.</p>\n");
  19         }
  20         else
  21                 stop('The registration key is invalid or expired. <a href="'.$_SERVER['PHP_SELF'].'">Re-register your account</a>.');
  22 }
  23
  24 if ( isset($_POST['submit'], $_POST['username'], $_POST['password'], $_POST['password2']) ) {
  25         $username = htmlspecialchars(trim($_POST['username']));
  26         $email = htmlspecialchars(trim($_POST['email']));
  27         $password = $_POST['password'];
  28         $errors = '';
  29
  30 // Check username first
  31         if ( !$username )
  32                 $errors = "You must enter a username.\n";
  33         elseif ( mysql_result(mysql_query('SELECT COUNT(*) FROM `users`
  34                         WHERE `name` = \''.mysql_real_escape_string($username).'\''), 0) >= 1 )
  35                 $errors = "The username $username is already registered.\n";
  36         elseif ( strlen($username) > 30 )
  37                 $errors = 'Your username is '.strlen($username)." characters long. Usernames must be 30 or less characters.\n";
  38
  39         if ( $username != htmlentities($username) )
  40                 $errors .= "Your username contains invalid characters.\n";
  41 // Check email next
  42         if ( !$email )
  43                 $errors .= "You must enter a valid email address.\n";
  44         elseif ( mysql_result(mysql_query('SELECT COUNT(*) FROM `users`
  45                         WHERE `register_email` = \''.mysql_real_escape_string($email).'\''), 0) >= 1 )
  46                 $errors .= "The e-mail $email has been used to register a username already.\n";
  47         elseif ( check_email($_POST['email']) )
  48                 $errors .= "The e-mail address given is either a freemail or banned site. Use a different address.\n";
  49
  50 // Check password next
  51         if ( empty($_POST['password']) )
  52                 $errors .= "You must enter a password.\n";
  53         elseif ( empty($_POST['password2']) )
  54                 $errors .= "You must confirm your password.\n";
  55         elseif ( $_POST['password'] != $_POST['password2'] )
  56                 $errors .= "Your passwords do not match.\n";
  57         elseif ( strlen($password) > 30 )
  58                 $errors .= 'Your password is '.strlen($password)." characters long. Passwords must be 30 or less characters.\n";
  59         elseif ( levenshtein($username, $password) < 4 )
  60                 $errors .= 'Your password is too similar to your username.'."\n";
  61
  62 // And then the ISP.
  63         if ( check_isp() )
  64                 $errors .= 'That ISP is banned from registering due to abuse.';
  65         elseif ( !empty($_SERVER['HTTP_X_FORWARDED_FOR']) )
  66                 $errors .= 'You are attempting to register from behind a proxy. Disable the proxy.';
  67
  68         if ( !empty($errors) )
  69                 echo '<div class="alert">',nl2br($errors),"</div>\n";
  70         else
  71         {
  72                 if ( !isset($_COOKIE['PHPSESSlD']) ) {
  73                         mysql_query('INSERT LOW_PRIORITY INTO `users` (
  74                                         `name`,
  75                                         `password`,
  76                                         `register_ip`,
  77                                         `register_email`,
  78                                         `private_email`,
  79                                         `register_date`,
  80                                         `useragent`
  81                                 ) VALUES (
  82                                         \''.mysql_real_escape_string($username).'\',
  83                                         \''.mysql_real_escape_string(encrypt($password, $_SERVER['REMOTE_ADDR'])).'\',
  84                                         INET_ATON(\''.$_SERVER['REMOTE_ADDR'].'\'),
  85                                         \''.mysql_real_escape_string($email).'\',
  86                                         \''.mysql_real_escape_string($email).'\',
  87                                         NOW(),
  88                                         \''.mysql_real_escape_string($_SERVER['HTTP_USER_AGENT']).'\'
  89                                 )');
  90                         $userid = mysql_insert_id($db);
  91                         $regkey = md5($username.$userid);
  92                 }
  93
  94                 echo '<p class="alert">Your username has been registered. ',
  95                         '<a href="?regkey=',$regkey,'">Go to this link</a> to confirm your account creation.</p>';
  96                 stop();
  97         }
  98 }
  99
 100 echo '<form class=',colour(),' method="post" action="',$_SERVER['PHP_SELF'],URL_STRING,'">
 101 <p>Fill in all fields to create an account.</p>
 102 <ul>
 103         <li><label>Username: <input type="text" maxlength="30" size="30" name="username" accesskey="u"/></label></li>
 104         <li><label>Password: <input type="password" maxlength="30" size="30" name="password" accesskey="p"/></label></li>
 105         <li><label>Confirm password: <input type="password" maxlength="40" size="40" name="password2" accesskey="c"/></label></li>
 106         <li><label>E-mail address: <input type="text" name="email" maxlength="50" accesskey="e"/></label></li>
 107         <li><input type="submit" name="submit" value="Register"/></li>
 108 </ul>
 109 </form>';
 110
 111 require 'foot.php';
 112 ?>