Secure Passwords

[curlyyh]

Here:

<?php 
session_start(); 
include_once "incfiles/connectdb.php"; 
 
$rand1 = rand(0,100);
$rand2 = rand(0,100);
$answer = $rand1 + $rand2;
 
if ($_POST['SubmitReg']){
$additional08989 = $_POST['additional']; 
$answers = $_POST['answers']; 
$register_user = $_POST['register_user']; 
$register_pass = $_POST['register_pass']; 
$register_pass2 = $_POST['register_pass2']; 
$register_gender = $_POST['register_gender']; 
$register_email = $_POST['register_email'];
$register_email2 = $_POST['register_email2']; 
$register_location=strip_tags($_POST['register_location']); 
$register_user=trim($register_user);
$register_pass=trim($register_pass); 
 
$today = gmdate('Y-m-d H:i:s');
 
$register_user = stripslashes($register_user); 
$register_email = stripslashes($register_email); 
$quote = stripslashes($quote); 
$register_user = strip_tags($register_user); 
$register_email = strip_tags($register_email); 
$number = $_POST['equals'];
 
if ($additional08989 != "GANCY78"){ echo "Use your head bro."; }
elseif ($additional08989 == "GANCY78"){
 
if((!$register_user) || (!$register_email) || (!$register_location) || (!$register_pass)){ 
echo "Please fill in all of the fields."; }else{
 
if ($number != "$answers"){ echo "Are you stupid bro? The answer is not $number."; }
elseif ($number == "$answers"){
 
 
if ($register_pass != $register_pass2){
echo "The passwords you entered do not match.";
}elseif ($register_pass == $register_pass2){
 
 
if ($register_email != $register_email2){
echo "The emails you entered do not match.";
}elseif ($register_email == $register_email2){
 
if ($register_user == "0"){ echo "Haha good joke, now try using an actual name?"; }
elseif ($register_user != "0"){ 
 
if (ereg('[^A-Za-z0-9 _]', $register_user)) {  
echo "You can't use symbols in your name.";
}elseif (!ereg('[^A-Za-z0-9 _]', $register_user)) { 
 
if (strlen($register_user) <= 2 || strlen($register_user) >= 20){
echo  "The username you entered is too big or too small.";
}elseif (strlen($register_user) > 2 || strlen($register_user) < 20){
 
$email_check = mysql_query("SELECT email FROM accounts WHERE email='$register_email' AND status='Alive'"); 
$username_check = mysql_query("SELECT username FROM accounts WHERE username='$register_user'"); 
 
$register_email_check = mysql_num_rows($email_check); 
$username_check = mysql_num_rows($username_check); 
 
if(($register_email_check > 0) || ($username_check > 0)){  
 
if($register_email_check > 0){ 
echo  "Some other gangster is already running that email address."; unset($register_email); } 
if($username_check > 0){ 
echo "some other gangster is already running that name."; unset($register_user); } 
 
}else{ 
 
$ip = $_SERVER['REMOTE_ADDR'];

[Dormilich]

I'm with one.com so it doesn't show me what line my errors on but I still can't seem to figure out how to secure this.

ini_set() and php_flags disabled?

If there's anything you can suggest/help me with it'd be appreciated.

use Prepared Statements, they’re immune to SQL Injection.

ah, yes, passwords should always be hashed before storing in a DB, that should render SQL Injection useless as well (if applied in PHP).

as a last resort you could use a RegExp to find invalid characters.

[curlyyh]

Could you show me a quick example in code as to what I'd be doing if it's okay?

[Dormilich]

there is too few information for anything code related.

[curlyyh]

can you see from line 41 all it decides is whether the password for the first box and the verify password box are the same.. I want it to be limited so you can only have passwords using, letters(lowercase&uppercase), numbers, underscores and dashes

[curlyyh]

Wait, sorry make that:

A-Z
a-z
0-9
underscores > (_)
dashes > (-)
fullstops > .
slash > /