Rejestracja

[PHP] pobierz, plaintext 
<?php
session_start();
include "core.php";
require_once "header.php";
 
function show_register() {
echo "<form name='inputform' method='post' action='register.php'>";
echo "<lable>Login</lable>";
echo "<input type='text' name='login'><br>";
echo "<lable>E-mial</lable>";
echo "<input type='text' name='email'><br>";
echo "<lable>Haslo</lable>";
echo "<input type='password' name='password1'><br>";
echo "<lable>Powtorz Haslo</lable>";
echo "<input type='password' name='password2'><br>";
echo "<input type='submit' name='register' value='register'>";
echo "</form>";
}
 
if((isset($_SESSION['user_logged']) && $_SESSION['user_logged'] != "" ||
(isset($_SESSION['user_password']) && $_SESSION['user_password'] !=""))) {
echo "jestes juz zalogowany";
} else {
if(isset($_POST["register"])){
$error = "";
$login = $_POST['login'];
$email = $_POST['email'];
$password = $_POST['password1'];
 
if($login == "" || $email == "" || $password == "") {
$error = "Uzupelnij Wszystkie Pola<br />\n";
}
 
if($password != $_POST["password2"]) {
$error = "Hasla nie pasuja do siebie<br />\n";
}
 
$result = mysql_query("SELECT * FROM rpg_users WHERE user_email='$email'");
if (mysql_num_rows($result) != 0) { 
$error = "E-mail już jest w bazie<br />\n"; 
}
 
$result = mysql_query("SELECT * FROM rpg_users WHERE user_login='$login'");
if (mysql_num_rows($result) != 0) { 
$error = "E-mail już jest w bazie<br />\n"; 
}
 
if($error == "") {
$result = mysql_query("INSERT INTO rpg_users(user_login, user_email, user_password) VALUES ('$login', '$email', '$password')");
echo "Rejestracja zakończona powiedzeniem! Mozesz sie zalogowac";
} else {
show_register();
}
} else {
show_register();
}
}
?>
[PHP] pobierz, plaintext 

logowanie

[PHP] pobierz, plaintext 
<?php
session_start();
include "core.php";
require_once "header.php";
 
function show_login_form(){
echo "<form name='inputform' method='post' action='login.php'>";
echo "<lable>Login</lable>";
echo "<input type='text' name='login'><br>";
echo "<lable>Haslo</lable>";
echo "<input type='password' name='password'><br>";
echo "<input type='submit' name='submit' value='submit'>";
echo "</form>";
}
 
if(isset($_POST['submit'])){
$error = "";
$login  = $_POST['login'];
$password = $_POST['password'];
 
    if($login == "" || $password == "") {
        $error = "Uzupelnij Wszystkie Pola<br />";
    }
 
$result = mysql_query("SELECT * FROM rpg_users WHERE user_login='".$login."' AND user_password='".$password."'");
    if(mysql_num_rows($result) == 0) {
        $error = "Podales zle dane sprobuj ponownie<br>";
    }
 
    if($error == "") {
$result = mysql_query("SELECT * FROM rpg_users WHERE user_login='".$login."' AND user_password='".$password."'");
        if(mysql_num_rows($result) == 1) {
            $_SESSION['user_logged'] = $login;
            $_SESSION['user_password'] = $password;
            echo "Zostales zalogowany";
        }
    } else {
        show_login_form();
    }
} else {
show_login_form();
}
 
?>
[PHP] pobierz, plaintext 

Wydaję mi się że wszystko działa. Ale czy to dobra droga ?

Skrypt podatny na sql injection

Logowań i rejestracji na forum Ci pod dostatkiem. Poszukaj, poczytaj. Bo 2000-ego logowania i powtarzania tego samego się odechciewa.
Temat: SQL Injection Insertion