instead using die in error

Question

i'm currently making a registration page. It includes hashing of password and validation. When I use "die" it stops the form and displays the error. I want to display the error on the same page.

<?php 

// First we execute our common code to connection to the database and start the session 
require("common.php"); 

$ErrorTest ="";
if(!empty($_POST)) 
{ 
    // Ensure that the user has entered a non-empty username 
    if(empty($_POST['username'])) 
    {
        $ErrorTest = "Please enter a username.";
    }       

    if(empty($_POST['password'])) 
    {
        $ErrorTest = "Please enter a password."; 
    }

    if(!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) 
    {
         $ErrorTest = "Invalid E-Mail Address";
    }   

    $query = " 
        SELECT 
            1 
        FROM users 
        WHERE 
            username = :username 
    "; 


    $query_params = array( 
        ':username' => $_POST['username'] 
    ); 

    try 
    { 
        $stmt = $db->prepare($query); 
        $result = $stmt->execute($query_params); 
    } 
    catch(PDOException $ex) 
    { 
        $ErrorTest = "Failed to run query: " . $ex->getMessage(); 
    } 
    $row = $stmt->fetch(); 

    if($row) 
    {
        $ErrorTest = "This email address is already registered";
    } 

    $query = " 
        SELECT 
            1 
        FROM users 
        WHERE 
            email = :email 
    "; 

    $query_params = array( 
        ':email' => $_POST['email'] 
    ); 

    try 
    { 
        $stmt = $db->prepare($query); 
        $result = $stmt->execute($query_params); 
    } 
    catch(PDOException $ex) 
    { 
        $ErrorTest ="Failed to run query: " . $ex->getMessage(); 
    } 

    $row = $stmt->fetch(); 

    if($row) 
    { 
        $ErrorTest =  "This username is already in use"; 
    } 

    $query = " 
        INSERT INTO users ( 
            username, 
            password, 
            salt, 
            email 
        ) VALUES ( 
            :username, 
            :password, 
            :salt, 
            :email 
        ) 
    "; 
    $salt = dechex(mt_rand(0, 2147483647)) . dechex(mt_rand(0, 2147483647)); 


    $password = hash('sha256', $_POST['password'] . $salt); 

    { 
        $password = hash('sha256', $password . $salt); 
    } 

    $query_params = array( 
        ':username' => $_POST['username'], 
        ':password' => $password, 
        ':salt' => $salt, 
        ':email' => $_POST['email'] 
    ); 

    try 
    { 
        $stmt = $db->prepare($query); 
        $result = $stmt->execute($query_params); 
    } 
    catch(PDOException $ex) 
    {  
        $ErrorTest = "Failed to run query: " . $ex->getMessage(); 
    } 

    // This redirects the user back to the login page after they register 
    header("Location: myprofile.php"); 
    $ErrorTest = "Redirecting to admin_login.php"; 
} 

?>

the die ("please enter a username") I want to display it on the same page. I tried also to put it on a javascript but when I put wrong infomation on one textboxes, it pop-ups all the error and displays the query.

Answer 1

The way I'd go about it is replacing die with a variable assignment to $error

i.e.

die("Failed to run query: " . $ex->getMessage());

replace with

$error = ("Failed to run query: " . $ex->getMessage());

and then wrap your registration logic with conditional statements checking if is set or if empty (up to you)

On your form you can then output this message using echo.

Edit

As you're redirecting to another page and not processing on the same page then adjust your code to

if($ErrorTest != ''){ header("Location: register.php?error=".$ErrorTest); } else{ header("Location: myprofile.php"); }

On the register.php page just check for the $_GET['error'] and then output it.

You're also always registering the user even if it errors so may be worth adding this code into the 'else'