Wsrtjtyk

So i have been taking a course in webdevelopment and while building a website i started having issues when creating register/login page. When i leave values blank in the register form and hit "submit". I get the errors missing "username, email, password etc." however, it stores the empty values in my database. Another issue, is when i type in the password, it will prompt me how long the password should be even after i put the correct value for password, then it doesn't prompt me to confirm the new passwords so they match. Even putting any password it will accept it and i will get both the error that the password should be at least 8 char long, 1 capital letter etc. but i will also get a "success" message saying that i have received an "activation link" in email. When i click the activation link, it say "activated" and says so in database, but when i try to login with the info, it says "wrong username or password".

I am very new to all this but i just could not find the solution to this.

This is my code in register

<!--Start a session-->

<?php

session_start();





//here we are connecting to db by linking the file to connection.php

include('connections.php');



//Check user inputs

//    Define error message



$missingUsername = '<p><strong>Please enter the username!</strong></p>';

$missingEmail = '<p><strong>Please enter your email!</strong></p>';

$invalidEmail = '<p><strong>Please enter a valid email</strong></p>';

$missingPassword = '<p><strong>Please enter a password!</strong></p>';

$invalidPassword = '<p><strong>Your password should be at least 8 characters long and include one capital letter and one number!</strong></p>';

$differentPassword2 = '<p><strong>The passwords don't match!</strong></p>';

$missingPassword2 = '<p><strong>Please enter password again</strong></p>';





//Get username, email, password, passwowrd2



//GET USERNAME

if(empty($_POST["username"])){



    $errors .= $missingUsername;



}else{

    $username = filter_var($_POST["username"], FILTER_SANITIZE_STRING);

}



//GET EMAIL

if(empty($_POST["email"])){



$errors .= $missingEmail;



}else{

    $email = filter_var($_POST["email"], FILTER_SANITIZE_EMAIL);



//    VALIDATING EMAIL if email invalid

if(!filter_var($email, FILTER_VALIDATE_EMAIL)){



    $errors .= $invalidEmail;

}    



}

//GET PASSWORDs



if(empty($_POST["password"])){



    $errors .= $missingPassword;



}elseif(!(strlen($_POST["password"])>8 

         and preg_match('/[A-Z]/',$_POST["password"])

         and preg_match('/[0-9]/',$_POST["password"]))){



    $errors .= $invalidPassword;



}else{

        $password = filter_var($_POST["password"], FILTER_SANITIZE_STRING);



//IF SECOND PASSWORD MISSING 



    if(empty($_POST["password2"])){



    $errors .= $missingPassword2;

}else{

    $password2 = filter_var($_POST["password2"], FILTER_SANITIZE_STRING);



        if($password !== $password2){



        $errors .= $differentPassword;

    }

  }

}



//IF THERE ARE ANY ERRROR    PRINT ERRORS



if($errors){

    $resultMessage = '<div class="alert alert-danger">' . $errors . '</div>';

    echo $resultMessage;

}



//IF THERE ARE NO ERRORS



$username = mysqli_real_escape_string($link,$username);



$email = mysqli_real_escape_string($link,$email);



$password = mysqli_real_escape_string($link,$password);



//hashing password



//$_Password = md5($_Password);

$password = hash('sha256',$password);

//128 bits -> 32 characters

//256 bits ->64 characters



//IF *USERNAME* EXISTS IN THE USERS TABLE PRINT ERROR





$sql = "SELECT * FROM users WHERE username = '$username'";

$result = mysqli_query($link, $sql);

if(!$result){

    echo '<div class="alert alert-danger">Error running the query!</div>';



    //echo '<div class="alert alert-danger">'. mysqli_error($link).'</div>';



    exit;

}

$results = mysqli_num_rows($result);

if($results){

    echo '<div class="alert alert-danger">That username is already registered. Do you want to log in?</div>';



    exit;

}



//IF THE *EMAIL* exists in the users table print error    



  $sql = "SELECT * FROM users WHERE email = '$email'";

$result = mysqli_query($link, $sql);

if(!$result){

    echo '<div class="alert alert-danger">Error running the query!</div>';



    exit;

}

$results = mysqli_num_rows($result);

if($results){

    echo '<div class="alert alert-danger">That email is already registered. Do you want to login?</div>';



    exit;

}



//CREATE A UNIQUE ACTIVATION CODE



$activationKey =

 bin2hex(openssl_random_pseudo_bytes(16));

//     bytes:unit of data = 8 bits

//     bit: 0 or 1

//     16 bytes = 16 * 8= 128 bits

//     (2*2*2*2)*2*2*2*2...*2

//     16*16*...*16

//     32 characters



//INSERT USER DETAILS AND ACTIVATION CODE IN THE USERS TABLE



 $sql = "INSERT INTO users (username, email, password, activation) VALUES ('$username', '$email', '$password', '$activationKey')";   



 $result =  mysqli_query($link, $sql);



 if(!$result){

     echo '<div class="alert alert-danger">There was an error inserting users detail in the database!</div>';



     exit;

 }   



 //SEND THE USER AN EMAIL WITH A LINK TO ACTIVATE.PHP WITH THEIR EMAIL AND ACTIVATION CODE

$message = "Please click on this link to activate your account:nn";

$message .= "" . urlencode($email) . "&key=$activationKey";



if(mail($email, 'Confirm your registration', $message, 'From:'.'muharem22@gmail.com')){



    echo "<div class='alert alert-success'>Thank you for registering! A confirmation email has been sent to $email. Please click on the activation link to activate your account!</div>";

}



?>

Here is a screen shot of my register form

Thank you for any suggestions/advice

The problem with empty entry in the database is because the code don't stop when found any error.

you have to add exit when found any error.

if($errors)

{

    $resultMessage = '<div class="alert alert-danger">' . $errors . '</div>';

    echo $resultMessage;

    exit;

}