$_POST['username'] ); try { // These two statements run the query against your database table. $stmt = $db->prepare($query); $result = $stmt->execute($query_params); } catch(PDOException $ex) { // Note: On a production website, you should not output $ex->getMessage(). // It may provide an attacker with helpful information about your code. die("Failed to run query: " . $ex->getMessage()); } // The fetch() method returns an array representing the "next" row from // the selected results, or false if there are no more rows to fetch. $row = $stmt->fetch(); // If a row was returned, then we know a matching username was found in // the database already and we should not allow the user to continue. if($row) { die("This username is already in use"); } // An INSERT query is used to add new rows to a database table. // Again, we are using special tokens (technically called parameters) to // protect against SQL injection attacks. $query = " INSERT INTO Users ( FirstName, LastName, UserName, Password, Salt, Email, WeeklyEmails, MassEmails, RegularPoints, ConferencePoints, SeasonWins, ConferenceId, OverallWins, OverallLosses, OverallTies, ConferenceWins, ConferenceLosses, ConferenceTies, UserType, Theme ) VALUES ( :firstName, :lastName, :username, :password, :salt, :email, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 ) "; // A salt is randomly generated here to protect again brute force attacks // and rainbow table attacks. The following statement generates a hex // representation of an 8 byte salt. Representing this in hex provides // no additional security, but makes it easier for humans to read. // For more information: // http://en.wikipedia.org/wiki/Salt_%28cryptography%29 // http://en.wikipedia.org/wiki/Brute-force_attack // http://en.wikipedia.org/wiki/Rainbow_table $salt = dechex(mt_rand(0, 2147483647)) . dechex(mt_rand(0, 2147483647)); // This hashes the password with the salt so that it can be stored securely // in your database. The output of this next statement is a 64 byte hex // string representing the 32 byte sha256 hash of the password. The original // password cannot be recovered from the hash. For more information: // http://en.wikipedia.org/wiki/Cryptographic_hash_function $password = hash('sha256', $_POST['password'] . $salt); // Next we hash the hash value 65536 more times. The purpose of this is to // protect against brute force attacks. Now an attacker must compute the hash 65537 // times for each guess they make against a password, whereas if the password // were hashed only once the attacker would have been able to make 65537 different // guesses in the same amount of time instead of only one. for($round = 0; $round < 65536; $round++) { $password = hash('sha256', $password . $salt); } // Here we prepare our tokens for insertion into the SQL query. We do not // store the original password; only the hashed version of it. We do store // the salt (in its plaintext form; this is not a security risk). $query_params = array(); $query_params[':firstName'] = $_POST['firstName']; $query_params[':lastName'] = $_POST['lastName']; $query_params[':username'] = $_POST['username']; $query_params[':password'] = $password; $query_params[':salt'] = $salt; $query_params[':email'] = $_POST['email']; try { // Execute the query to create the user $stmt = $db->prepare($query); $result = $stmt->execute($query_params); } catch(PDOException $ex) { // Note: On a production website, you should not output $ex->getMessage(). // It may provide an attacker with helpful information about your code. die("Failed to run query: " . $ex->getMessage()); } ?>

Registration successful. Redirecting in 3 seconds...

Register

First Name:


Last Name:


Username:


E-Mail:


Password: