ZenCMS :: It has finally started!

[Zenax]

OK so i have finally started creating my CMS. I have already written up the registration script that allows you to register an account.

So basically what I want you to do is to test out my registration script, take a look at the overall design of the script and also how secure it is. The idea of ZenCMS is to provide an easy to use CMS that will also have really good security on it.

Try it out here:
http://zenax.x10hosting.com/ZenCMS/register/

I am now writing the login script that will also hopefully have the right amount of security, and I will post when I have completed it, which will hopefully be later today.

Many Regards,
Zenax

EDIT:
Please just gimme a hand with this as well:

<?Php
if (isset($_POST['submit'])) {

// including the db connection script
require_once("connect_db.php");

// declaring the variables
$username = $_POST['username'];
$password = md5($_POST['password']);
$passrept = $_POST['passrept'];
$email  = $_POST['emailaddy'];

// stripping HTML tags from the info entered
$username = strip_tags($_POST['username']);
$password = strip_tags($_POST['password']);
$passrept = strip_tags($_POST['passrept']);
$email = strip_tags($_POST['emailaddy']);

// Checking a username is not already taken
$q = mysql_query("SELECT * FROM users WHERE users = '$username'") or die(mysql_error());
    if(mysql_num_rows($q) > 0)
        {

            echo '<script>alert("The username you entered is already in use, please try again.");</script>';
            echo '<script>history.back(1);</script>';
            exit;

        }
else {

// Checking the two passwords match each other
if ($password != $passrept) {
    echo '<script>alert("The passwords did not match.");</script>';
    echo '<Script>history.back(1);</script>';
    exit;
    
    }
    
// Checking the format of the email address
if (!preg_match("/.*@.*..*/", $email) || preg_match("/(<|>)/", $email)) {
    echo '<script>alert("Invalid Email Address");</script>';
    echo '<script>history.back(1);</script>';
    exit;
    
    }

// inserting the data into the db
$insert = mysql_query("INSERT INTO users VALUES ('". $_POST['username'] ."', '". $_POST['password'] ."', '". $_POST['emailaddy'] ."') ")
    or die("Could not insert data because ".mysql_error());
    
header( 'Location: register_success.php' ) ;

}

}

?>

something produces this error:

Could not insert data because Column count doesn't match value count at row 1

I left in the code because I want it to be open source.

I also update my SQL file to this:

... Removed the comments to shorten post length ...

CREATE TABLE `users` (
  `users` varchar(40) NOT NULL,
  `password` varchar(50) NOT NULL,
  `emailaddy` varchar(50) NOT NULL
) ENGINE=MyISAM DEFAULT CHARSET=latin1;

-- 
-- Dumping data for table `users`
-- 

INSERT INTO `users` (`users`, `password`) VALUES 
('test', 'test'),
('test1', 'test1')

I am thinking that somewhere I forgot to do something and also it has something to do with updating the script.

Sorry if this post seems really long to you!

[trev]

<?Php
if (isset($_POST['submit'])) {

// including the db connection script
require_once("connect_db.php");

// declaring the variables
$username = $_POST['users'];
$password = md5($_POST['password']);
$passrept = $_POST['passrept'];
$email  = $_POST['emailaddy'];

// stripping HTML tags from the info entered
$username = strip_tags($_POST['users']);
$password = strip_tags($_POST['password']);
$passrept = strip_tags($_POST['passrept']);
$email = strip_tags($_POST['emailaddy']);

// Checking a username is not already taken
$q = mysql_query("SELECT * FROM users WHERE users = '$username'") or die(mysql_error());
    if(mysql_num_rows($q) > 0)
        {

            echo '<script>alert("The username you entered is already in use, please try again.");</script>';
            echo '<script>history.back(1);</script>';
            exit;

        }
else {

// Checking the two passwords match each other
if ($password != $passrept) {
    echo '<script>alert("The passwords did not match.");</script>';
    echo '<Script>history.back(1);</script>';
    exit;
    
    }
    
// Checking the format of the email address
if (!preg_match("/.*@.*..*/", $email) || preg_match("/(<|>)/", $email)) {
    echo '<script>alert("Invalid Email Address");</script>';
    echo '<script>history.back(1);</script>';
    exit;
    
    }

// inserting the data into the db
$insert = mysql_query("INSERT INTO users VALUES ('". $_POST['users'] ."', '". $_POST['password'] ."', '". $_POST['emailaddy'] ."') ")
    or die("Could not insert data because ".mysql_error());
    
header( 'Location: register_success.php' ) ;

}

}

?>

Try that and see if it clears up ur error.

[Zenax]

Its fixed! What on earth did you change? anyway thanks for your help trev. Now all i need is for people to let me know of what they think of the design and also how secure is it?

[trev]

I think u changed the username rob in ur database to user so ur values in the php script needed changing to fit in. Sorry cant help with securing the script i can only fault find.

[Zenax]

thats ok. what do you think of the overall design? second off will people have a look at the security and see how secure it is?!?

[trev]

Its realy secure it wont let u register anything i do results in a username already taken i very much doubt someone was a username qwertyuiop2007 already!!

[Zenax]

yeah about that. I noticed that the names used on the form and the names used in the script didnt match each other, hence they were not being inserted, and it automatically thought they were taken!

Problem solved now!

[noerrorsfound]

Trying to log in:

Fatal error: Call to a member function query() on a non-object in /home/zenax/public_html/ZenCMS/login/index.php on line 63

[Zenax]

yeah the login script aint done, I am currently working to get that fixed! which basically means re-writing it!

[Zenax]

Ok I have finally cracked it. You can register with ease, and any problems there once was with that script have been fixed. I now have the login script working as well.

You can view reigster script here:
http://zenax.x10hosting.com/ZenCMS/register/

You can view login script here:
http://zenax.x10hosting.com/ZenCMS/login/

You can use a test account:
User: madman
Pass: madman

This will log you in. You can register your own if you so very wish!

Please let me know if you encounter any problems.

Please note the session keep does not work but that is the only feature missing!

Regards,
Zenax