codice:
<?php
@include('connect_db.php');
session_start();
if(isset($_SESSION['loggedin']) == "1"){
header('location: index.php');
}
//controlliamo se i dati sono stati inseriti
if(!isset($_POST['username']) || $_POST['username']=="" || !isset($_POST['email']) || $_POST['email'] == "" || !isset($_POST['password']) || $_POST['password']=="" || !isset($_POST['password2']) || $_POST['password2']=="" || !isset($_POST['datay']) || $_POST['datay']=="" || !isset($_POST['datam']) || $_POST['datam']=="" || !isset($_POST['datad']) || $_POST['datad']=="" || !isset($_POST['paese']) || $_POST['paese']=="" || !isset($_POST['nome']) || $_POST['nome']=="" || !isset($_POST['cognome']) || $_POST['cognome']==""){
header('location: register.php?message=registererror1');
} else {
//puliamo i dati
$username = trim(filter_var($_POST['username'], FILTER_SANITIZE_STRING));
$username = ereg_replace("[^A-Za-z0-9_\-\./, ]", "", $username);
$username = mysql_real_escape_string($username);
$username = trim(filter_var($username, FILTER_SANITIZE_SPECIAL_CHARS));
$email = trim(filter_var($_POST['email'], FILTER_SANITIZE_STRING));
$email = ereg_replace("[^A-Za-z0-9_\-\./, ]", "", $email);
$email = mysql_real_escape_string($email);
$email = trim(filter_var($email, FILTER_SANITIZE_SPECIAL_CHARS));
$password = trim(filter_var($_POST['password'], FILTER_SANITIZE_STRING));
$password = ereg_replace("[^A-Za-z0-9_\-\./, ]", "", $password);
$password = mysql_real_escape_string($password);
$password = trim(filter_var($password, FILTER_SANITIZE_SPECIAL_CHARS));
$password2 = trim(filter_var($_POST['password2'], FILTER_SANITIZE_STRING));
$password2 = ereg_replace("[^A-Za-z0-9_\-\./, ]", "", $password2);
$password2 = mysql_real_escape_string($password2);
$password2 = trim(filter_var($password2, FILTER_SANITIZE_SPECIAL_CHARS));
$datay = trim(filter_var($_POST['datay'], FILTER_SANITIZE_STRING));
$datay = ereg_replace("[^A-Za-z0-9_\-\./, ]", "", $datay);
$datay = mysql_real_escape_string($datay);
$datay = trim(filter_var($datay, FILTER_SANITIZE_SPECIAL_CHARS));
$datam = trim(filter_var($_POST['datam'], FILTER_SANITIZE_STRING));
$datam = ereg_replace("[^A-Za-z0-9_\-\./, ]", "", $datam);
$datam = mysql_real_escape_string($datam);
$datam = trim(filter_var($datam, FILTER_SANITIZE_SPECIAL_CHARS));
$datad = trim(filter_var($_POST['datad'], FILTER_SANITIZE_STRING));
$datad = ereg_replace("[^A-Za-z0-9_\-\./, ]", "", $datad);
$datad = mysql_real_escape_string($datad);
$datad = trim(filter_var($datad, FILTER_SANITIZE_SPECIAL_CHARS));
$paese = trim(filter_var($_POST['paese'], FILTER_SANITIZE_STRING));
$paese = ereg_replace("[^A-Za-z0-9_\-\./, ]", "", $paese);
$paese = mysql_real_escape_string($paese);
$paese = trim(filter_var($paese, FILTER_SANITIZE_SPECIAL_CHARS));
$nome = trim(filter_var($_POST['nome'], FILTER_SANITIZE_STRING));
$nome = ereg_replace("[^A-Za-z0-9_\-\./, ]", "", $nome);
$nome = mysql_real_escape_string($nome);
$nome = trim(filter_var($nome, FILTER_SANITIZE_SPECIAL_CHARS));
$cognome = trim(filter_var($_POST['cognome'], FILTER_SANITIZE_STRING));
$cognome = ereg_replace("[^A-Za-z0-9_\-\./, ]", "", $cognome);
$cognome = mysql_real_escape_string($cognome);
$cognome = trim(filter_var($cognome, FILTER_SANITIZE_SPECIAL_CHARS));
if ($password != $password2) {
header('location: register.php?message=registererror2');
}
else
{
//generiamo l'hash
$md5 = md5($password);
$num_at = count(explode( '@', $email )) - 1;
if($num_at != 1) {
header('location: register.php?message=registererror3');
}
else
{
if(!preg_match( '/^[\w\.\-]+@\w+[\w\.\-]*?\.\w{1,4}$/', $email)) {
header('location: register.php?message=registererror3');
}
else
{
$result = mysql_query("SELECT * FROM utenti WHERE username = '$username'") or die (mysql_error());
$result2 = mysql_query("SELECT * FROM utenti WHERE email = '$email'") or die (mysql_error());
if(mysql_num_rows($result) >= 1){
header('location: index.php?message=registererror4');
}else{
if(mysql_num_rows($result2) >= 1){
header('location: index.php?message=registererror5');
}
else
{
$datanascita = $datad + '-' + $datam + '-' + $datay;
$check = rand(10000,99999);
//inserimento utente nel database
mysql_query("INSERT INTO utenti (id,username,password,email,data_nascita,paese,nome,cognome,data_registrazione,ipaddress,check,stato) VALUES ('',$username,$md5,$email,$datanascita,$paese,$nome,$cognome,now(),$_SERVER['REMOTE_ADDR'],$check,0)") or die (mysql_error());
header('location: register.php?message=registerok');
}
}
}
}
}
}
?>
[/SPOILER]