I'm struggling to build a PHP registration script using PDO prepared statements with positional placeholders. But the MySQL queries don't execute.
`var_dump();` doesn't display any error.

register.php:

``````<?php

// include configuration file
require ("includes/config.php");

//classes is the map where the class file is stored (one above the root)

// if form was submitted
if (\$_SERVER["REQUEST_METHOD"] == "POST")
{

\$firstname = student_input(\$_POST["firstname"]);
\$lastname = student_input(\$_POST["lastname"]);
\$gender = student_input(\$_POST["gender"]);
\$email = student_input(\$_POST["email"]);
\$birthday = student_input(\$_POST["birthday"]);
\$phone = student_input(\$_POST["phone"]);

// validate submission
if (empty(\$_POST["firstname"]))
{
\$errorMsg[] = "First name is required.";
}
else if(empty(\$_POST["lastname"]))
{
\$errorMsg[] = "Last name is required.";
}
{
}
{
{
\$errorMsg[] = "Username must contain only letters and numbers.";
}
{
\$errorMsg[] = "Username must be from 4 to 10 characters.";
}
}
else if(empty(\$_POST["gender"]))
{
\$errorMsg[] = "Gender is required.";
}
{
}
{
{
\$errorMsg[] = "Password must contain letters, numbers and special characters.";
}
{
\$errorMsg[] = "Password must be from 8 to 15 characters.";
}
}
else if (empty(\$_POST["confirmation"]))
{
}
{
\$errorMsg[] = "Password and confirmation don't match.";
}
else if(empty(\$_POST["email"]))
{
}
else if(!filter_var(\$email, FILTER_VALIDATE_EMAIL))
{
\$errorMsg[] = "Invalid email format";
}
else if(empty(\$_POST["birthday"]))
{
\$errorMsg[] = "Birthday is required.";
}
else if(!empty(\$_POST["birthday"]))
{
\$birthday = student_input(\$_POST["birthday"]);
\$today = date("d-m-Y");
\$diff = date_diff(date_create(\$birthday), date_create(\$today));

if(\$diff->format('%y%') < 6)
{
\$errorMsg[] = "You must be at least 6 years old to register.";
}
}
else if(empty(\$_POST["phone"]))
{
\$errorMsg[] = "Phone number is required.";
}
else if(!empty(\$_POST["phone"]))
{
// Don't allow country codes to be included (assumes a leading "+")
if (preg_match('/^(\+)[\s]*(.*)\$/',\$phone))
{
\$errorMsg[] = "You should not include the country code.";
}
// Remove hyphens - they are not part of a telephone number
\$phone = str_replace ('-', '', \$phone);

// Now check that all the characters are digits
if (!preg_match('/^[0-9]{10,11}\$/',\$phone))
{
\$errorMsg[] = "Phone number should be either 10 or 11 digits";
}

// Now check that the first digit is 0
if (!preg_match('/^0[0-9]{9,10}\$/',\$phone))
{
}
}
else if(!empty(\$_FILES["userimage"]))
{
//This is the directory where images will be saved

\$my_upload->upload_dir = "images/user/"; // "files" is the folder for the uploaded files (you have to create this folder)
\$my_upload->extensions = array(".png", ".gif", ".jpeg", ".jpg"); // specify the allowed extensions here
// \$my_upload->extensions = "de"; // use this to switch the messages into an other language (translate first!!!)
\$my_upload->max_length_filename = 50; // change this value to fit your field length in your database (standard 100)

\$my_upload->do_filename_check = "n"; // use this boolean to check for a valid filename
{
}
else
{
\$imagename = "";
}
}
else
{
try
{
\$stmt = \$pdo->prepare("SELECT * FROM users WHERE username = ?");
\$user = \$stmt->fetch(); # get users data

{
}
else if(\$user["email"]==\$email)
{
}
else if(\$user["phone"]==\$phone)
{
}
else if(!isset(\$errorMsg)) //check no "\$errorMsg" show then continue
{

// insert form input into database
\$result = "INSERT INTO users (firstname, lastname, username, gender, password, email, birthday, phone, userimage) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)";
\$stmt= \$pdo->prepare(\$result);

// if data is in database
{
// find out user's ID
\$stmt = \$pdo->query("SELECT LAST_INSERT_ID() AS user_id");
\$user_id = \$stmt["user_id"];

// redirect to list users page
}
}
}
catch(PDOException \$e)
{
echo \$e->getMessage();
}

}
}

include("templates/register-form.php");

// render the footer template
include("templates/footer.php");
?>``````

I have the following, relevant code in the functions.php, which is called by the config.php:

``````// validate user input
function student_input(\$data) {
\$data = trim(\$data);
\$data = stripslashes(\$data);
\$data = htmlspecialchars(\$data);
return \$data;
}``````

Another thing: how do I print the errors on the register-form.php right below any existing error's input field?
register-form.php:

``````<br>
<br>
<h1>Register</h1>
<br>
<form enctype="multipart/form-data" action="register.php" method="post">
<fieldset>
<div class="form-group">
<label>First Name:</label><span class ="error">*</span> <input autofocus class="form-control" name="firstname" placeholder="First Name" type="text"/>
<span class = "error"><?php //echo \$errorMsg["firstname"];?></span>
</div>
<div class="form-group">
<label>Last Name:</label><span class ="error">*</span> <input class="form-control" name="lastname" placeholder="Last Name" type="text"/><br />
<span class = "error"><?php //echo \$errorMsg["lastname"];?></span>
</div>
<div class="form-group">
<span class = "error"><?php //echo \$errorMsg["username"];?></span>
</div>
<div class="form-group">
<label>Gender:</label><span class ="error">*</span> <select class="form-control" name="gender" value="gender">
<option value="Male">Male</option>
<option value="Female">Female</option>
</select><br />
<span class = "error"><?php //echo \$error;?></span>
</div>
<div class="form-group">
<span class = "error"><?php //echo \$error;?></span>
</div>
<div class="form-group">
<span class = "error"><?php //echo \$error;?></span>
</div>
<div class="form-group">
<label>Email:</label><span class ="error">*</span> <input class="form-control" name="email" placeholder="Email" type="text"/><br />
<span class = "error"><?php //echo \$error;?></span>
</div>
<div class="form-group">
<label>Phone:</label><span class ="error">*</span> <input class="form-control" name="phone" placeholder="Phone" type="tel" min="10" max="11"/><br />
<span class = "error"><?php //echo \$error;?></span>
</div>
<div class="form-group">
<label>Date of Birth:</label><span class ="error"></span> <input class="form-control" name="birthday" placeholder="birthday" type="date" /><br />
<span class = "error"><?php //echo \$error[birthday];?></span>
</div>
<div class="form-group">
<label>Passport Photo:</label><input class="form-control" name="userimage" id="fileimage" placeholder="Your Photo" type="file"/>
</div>
<div class="form-group">
<button type="submit" class="btn btn-default" name="Register" value="Register">Register</button>
</div>
</fieldset>
</form>
<div>
</div>
<br/>
<br>
<br>``````

I think this is a good thing it failed. Why? From the code it looks like the password is stored in the database in the clear. This is no longer and acceptable practice.

With that out of the way, use your debugging skills to track down what the variables are at the time of failure.
Nod to https://www.w3schools.com/php/func_var_var_dump.asp

@rproffit,
I just modified insert query in the register.php file, but still the queries don't execute.

Is the modified approach the best secure way of storing password?

``````<?php

// include configuration file
require ("includes/config.php");

//classes is the map where the class file is stored (one above the root)

// if form was submitted
if (\$_SERVER["REQUEST_METHOD"] == "POST")
{

\$firstname = student_input(\$_POST["firstname"]);
\$lastname = student_input(\$_POST["lastname"]);
\$gender = student_input(\$_POST["gender"]);
\$email = student_input(\$_POST["email"]);
\$birthday = student_input(\$_POST["birthday"]);
\$phone = student_input(\$_POST["phone"]);

// validate submission
if (empty(\$_POST["firstname"]))
{
\$errorMsg[] = "First name is required.";
}
else if(empty(\$_POST["lastname"]))
{
\$errorMsg[] = "Last name is required.";
}
{
}
{
{
\$errorMsg[] = "Username must contain only letters and numbers.";
}
{
\$errorMsg[] = "Username must be from 4 to 10 characters.";
}
}
else if(empty(\$_POST["gender"]))
{
\$errorMsg[] = "Gender is required.";
}
{
}
{
{
\$errorMsg[] = "Password must contain letters, numbers and special characters.";
}
{
\$errorMsg[] = "Password must be from 8 to 15 characters.";
}
}
else if (empty(\$_POST["confirmation"]))
{
}
{
\$errorMsg[] = "Password and confirmation don't match.";
}
else if(empty(\$_POST["email"]))
{
}
else if(!filter_var(\$email, FILTER_VALIDATE_EMAIL))
{
\$errorMsg[] = "Invalid email format";
}
else if(empty(\$_POST["birthday"]))
{
\$errorMsg[] = "Birthday is required.";
}
else if(!empty(\$_POST["birthday"]))
{
\$birthday = student_input(\$_POST["birthday"]);
\$today = date("d-m-Y");
\$diff = date_diff(date_create(\$birthday), date_create(\$today));

if(\$diff->format('%y%') < 6)
{
\$errorMsg[] = "You must be at least 6 years old to register.";
}
}
else if(empty(\$_POST["phone"]))
{
\$errorMsg[] = "Phone number is required.";
}
else if(!empty(\$_POST["phone"]))
{
// Don't allow country codes to be included (assumes a leading "+")
if (preg_match('/^(\+)[\s]*(.*)\$/',\$phone))
{
\$errorMsg[] = "You should not include the country code.";
}
// Remove hyphens - they are not part of a telephone number
\$phone = str_replace ('-', '', \$phone);

// Now check that all the characters are digits
if (!preg_match('/^[0-9]{10,11}\$/',\$phone))
{
\$errorMsg[] = "Phone number should be either 10 or 11 digits";
}

// Now check that the first digit is 0
if (!preg_match('/^0[0-9]{9,10}\$/',\$phone))
{
}
}
else if(!empty(\$_FILES["userimage"]))
{
//This is the directory where images will be saved

\$my_upload->upload_dir = "images/user/"; // "files" is the folder for the uploaded files (you have to create this folder)
\$my_upload->extensions = array(".png", ".gif", ".jpeg", ".jpg"); // specify the allowed extensions here
// \$my_upload->extensions = "de"; // use this to switch the messages into an other language (translate first!!!)
\$my_upload->max_length_filename = 50; // change this value to fit your field length in your database (standard 100)

\$my_upload->do_filename_check = "n"; // use this boolean to check for a valid filename
{
}
else
{
\$imagename = "";
}
}
else
{
try
{
\$stmt = \$pdo->prepare("SELECT * FROM users WHERE username = ?");
\$user = \$stmt->fetch(); # get users data

{
}
else if(\$user["email"]==\$email)
{
}
else if(\$user["phone"]==\$phone)
{
}
else if(!isset(\$errorMsg)) //check no "\$errorMsg" show then continue
{

// insert form input into database
\$stmt= \$pdo->prepare("INSERT INTO users (firstname, lastname, username, gender, password, email, birthday, phone, userimage) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)")->execute(\$data);

// find out user's ID
\$stmt = \$pdo->query("SELECT LAST_INSERT_ID() AS user_id");
\$user_id = \$stmt["user_id"];

// redirect to list users page
}
}
catch(PDOException \$e)
{
echo \$e->getMessage();
}

}
}

include("templates/register-form.php");

// render the footer template
include("templates/footer.php");
?>``````

I've tried to use `var_dump();`, but I haven't managed to figure out how to fix the issue.

var_dump(); alone would do nothing. It's one of your tools to inspect variables so you can check for syntax and content just before your query.

I can't do the dumps for you. You must write the code to dump and then inspect the query for issues.

As to securing your passwords I shared the prior discussions about storing passwords. There are many fine articles about that topic so here's one on Daniweb. I can't guess if it's going to work for you but the basic idea is you never store a password. You store the result of a one-way encyption that is salted. And if you are new to encryption and don't know what salting is, well, time to google that for priors. There are plenty of priors here.

@rproffitt,
Thanks for your continued interest and input. Well, I don't expect you to write the code for me, but I desperately need someone to closely look at my code and explain to me why the queries don't execute.

Below is a rewrite of register.php, whic now displays errors if certain, predefined conditions are not met. However, it doesn't display any error, when the insert or select query fail.

``````<?php

// include configuration file
require ("includes/config.php");

//classes is the map where the class file is stored (one above the root)

// define variables and set to empty values
\$firstnameErr = \$lastnameErr = \$usernameErr = \$genderErr = \$passwordErr = \$confirmationErr = \$emailErr = \$birthdayErr = \$phoneErr = "";
\$firstname = \$lastname = \$username = \$gender = \$password = \$confirmation = \$email = \$birthday = \$phone = "";

// if form was submitted
if (\$_SERVER["REQUEST_METHOD"] == "POST")
{

\$firstname = student_input(\$_POST["firstname"]);
\$lastname = student_input(\$_POST["lastname"]);
\$gender = student_input(\$_POST["gender"]);
\$confirmation = student_input(\$_POST["confirmation"]);
\$email = student_input(\$_POST["email"]);
\$birthday = student_input(\$_POST["birthday"]);
\$phone = student_input(\$_POST["phone"]);

// validate submission
if (empty(\$_POST["firstname"]))
{
\$firstnameErr = "First name is required.";
}
else
{
\$firstname = student_input(\$_POST["firstname"]);
}
if(empty(\$_POST["lastname"]))
{
\$lastnameErr = "Last name is required.";
}
else
{
\$lastname = student_input(\$_POST["lastname"]);
}
{
}
{
{
}
{
}
}
else
{
}
if(empty(\$_POST["gender"]))
{
\$genderErr = "Gender is required.";
}
else
{
\$gender = student_input(\$_POST["gender"]);
}
{
}
{
{
}
{
}
}
else if (empty(\$_POST["confirmation"]))
{
}
{
\$confirmationErr = "Password and confirmation don't match.";
}
else
{
}
if(empty(\$_POST["email"]))
{
}
else if(!filter_var(\$email, FILTER_VALIDATE_EMAIL))
{
\$emailErr = "Invalid email format";
}
else
{
\$email = student_input(\$_POST["email"]);
}
if(empty(\$_POST["birthday"]))
{
\$birthdayErr = "Birthday is required.";
}
else if(!empty(\$_POST["birthday"]))
{
\$today = date("d-m-Y");
\$diff = date_diff(date_create(\$birthday), date_create(\$today));

if(\$diff->format('%y%') < 6)
{
\$birthdayErr = "You must be at least 6 years old to register.";
}
else
{
\$birthday = student_input(\$_POST["birthday"]);
}
}
if(empty(\$_POST["phone"]))
{
\$phoneErr = "Phone number is required.";
}
else if(!empty(\$_POST["phone"]))
{
// Don't allow country codes to be included (assumes a leading "+")
if (preg_match('/^(\+)[\s]*(.*)\$/',\$phone))
{
\$phoneErr = "You should not include the country code.";
}
// Remove hyphens - they are not part of a telephone number
\$phone = str_replace ('-', '', \$phone);

// Now check that all the characters are digits
if (!preg_match('/^[0-9]{10,11}\$/',\$phone))
{
\$phoneErr = "Phone number should be either 10 or 11 digits";
}

// Now check that the first digit is 0
if (!preg_match('/^0[0-9]{9,10}\$/',\$phone))
{
}
else
{
\$phone = student_input(\$_POST["phone"]);
}
}
else if(!empty(\$_FILES["userimage"]))
{
//This is the directory where images will be saved

\$my_upload->upload_dir = "images/user/"; // "files" is the folder for the uploaded files (you have to create this folder)
\$my_upload->extensions = array(".png", ".gif", ".jpeg", ".jpg"); // specify the allowed extensions here
// \$my_upload->extensions = "de"; // use this to switch the messages into an other language (translate first!!!)
\$my_upload->max_length_filename = 50; // change this value to fit your field length in your database (standard 100)

\$my_upload->do_filename_check = "n"; // use this boolean to check for a valid filename
{
}
else
{
\$imagename = "";
}
}
else
{
try
{
\$stmt = \$pdo->prepare("SELECT * FROM users WHERE username = ?");
\$user = \$stmt->fetch(); # get users data

{
}
else if(\$user["email"]==\$email)
{
}
else if(\$user["phone"]==\$phone)
{
}
else if(!isset(\$errorMsg)) //check no "\$errorMs g" show then continue
{

// insert form input into database
\$stmt= \$pdo->prepare("INSERT INTO users (firstname, lastname, username, gender, password, email, birthday, phone, userimage) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)")->execute(\$data);

// find out user's ID
\$stmt = \$pdo->query("SELECT LAST_INSERT_ID() AS user_id");
\$user_id = \$stmt["user_id"];

// redirect to list users page
}
}
catch(PDOException \$e)
{
echo \$e->getMessage();
}

}
}
{"ft_lang_label":"__label__en","ft_lang_prob":0.5322051,"math_prob":0.8167025,"size":9226,"snap":"2020-34-2020-40","text_gpt3_token_len":2331,"char_repetition_ratio":0.15636522,"word_repetition_ratio":0.06873185,"special_character_ratio":0.33275527,"punctuation_ratio":0.16364902,"nsfw_num_words":0,"has_unicode_error":false,"math_prob_llama3":0.9523642,"pos_list":[0],"im_url_duplicate_count":[null],"WARC_HEADER":"{\"WARC-Type\":\"response\",\"WARC-Date\":\"2020-08-12T00:40:47Z\",\"WARC-Record-ID\":\"<urn:uuid:61266436-9998-4563-8bba-a223f540d3dd>\",\"Content-Length\":\"101522\",\"Content-Type\":\"application/http; msgtype=response\",\"WARC-Warcinfo-ID\":\"<urn:uuid:d24897be-e04a-460f-9436-1392fae3464f>\",\"WARC-Concurrent-To\":\"<urn:uuid:daf177bc-c87f-47e3-b47b-c0251eb5cec7>\",\"WARC-IP-Address\":\"172.67.7.242\",\"WARC-Target-URI\":\"https://www.daniweb.com/programming/web-development/threads/523286/how-can-i-get-this-php-registration-using-pdo-prepared-statements-to-work\",\"WARC-Payload-Digest\":\"sha1:CJAO7FS3CE6TMFEL6CPK3ELS5DODR6Y3\",\"WARC-Block-Digest\":\"sha1:BF6UQDRXVXSYX4GYJM3I4DCDN6UG3BH6\",\"WARC-Identified-Payload-Type\":\"text/html\",\"warc_filename\":\"/cc_download/warc_2020/CC-MAIN-2020-34/CC-MAIN-2020-34_segments_1596439738858.45_warc_CC-MAIN-20200811235207-20200812025207-00181.warc.gz\"}"}