function addusr($conn)
{
echo "COMP344 Assignment 1, 2012 by Ali Alavi - #40876144<br>";
global $firstname, $lastname, $username, $email, $password;
$password_enc = createEnc($password);
//Stop script if email account is empty after sanitization process(used for error checking by myself)
if ($email == null) {
exit('Unable to create account');
}
//check username - validate server side
$s = oci_parse($conn, "select email from tblusers where username=:username_prefix");
oci_bind_by_name($s, ':username_prefix', $username);
oci_execute($s);
$res = oci_fetch_array($s);
if ($res) {
oci_free_statement($s);
oci_close($conn);
echo 'Could not register user, account already exists.</br> <a href="index.html">Return to login page</a>';
return false;
} else {
/* *** A1 - Injection attacks, converted all SQL statments to include binding/placeholders to prevent injection attacks.
*
*/
//build sql command to register new user
$s = oci_parse($conn, "INSERT INTO TBLUSERS (FIRSTNAME, LASTNAME, EMAIL, USERNAME, PASSWORD) VALUES (:fn, :ln, :e, :un, :pw)");
//execute insert statement
oci_bind_by_name($s, ':un', $username);
oci_bind_by_name($s, ':fn', $firstname);
oci_bind_by_name($s, ':ln', $lastname);
oci_bind_by_name($s, ':e', $email);
oci_bind_by_name($s, ':pw', $password_enc);
oci_execute($s);
oci_free_statement($s);
oci_close($conn);
return true;
}
}
oci_free_statement($s);
oci_close($conn);
echo "Username or password were incorrect.</br> Please try to login again, <a href='login.html'>click to return to login page</a>.";
return false;
}
}
//call database connection function
$newconn = conndb();
//call add user to database funtion
$loginUsr = loginChk($newconn);
//once login is succesfull, create seassion and forward user
if ($loginUsr) {
//echo 'logged in';
session_start();
global $username;
$encrypted_data = createEnc($username);
$_SESSION['email'] = $encrypted_data;
$_SESSION['loggedin'] = time();
$_SESSION['token'] = session_id();
//addSessDb($newconn);
session_write_close();
//sess to db
/* *** A10 - Unvalidated Redirects and Forwards. Only relative url is given and the full/absolute is avoided.
*
*/
header("location: main.php");
}
?>