<?php 

include("config.php"); 

### I found this sanitizer here: http://blog.mypapit.net/2006/08/owasp-php-filters-helps-filter-php-variables.html
require('sanitize.inc.php');
$username = sanitize($_POST['username'],SQL);
$password = sanitize($_POST['password'],SQL);
$emailadr = sanitize($_POST['email'],SQL);

if ( (!isset($_POST['username']) || !isset($_POST['password']) || !isset($_POST['email'])) || 
	($username =="") || ($password == "") || ($emailadr == "") ){
?>
<html><head>
<title>User Registration</title>
<link rel="stylesheet" href="Text.css" type="text/css">
</head><body>

<p>
<form action="register.php" method="post">
Pick a Username: <input type="text" name="username" size="20" value=<? echo $username; ?> ><br>
Pick a Password: <input type="password" name="password" size="20"><br>
Email Address: <input type="text" name="email" size="20" value=<? echo $emailadr; ?> ><br>
<input type="submit" value="Sign Up">
</form>
</p>

<?
	if( $_POST['username'] ||  $_POST['password'] ||  $_POST['email'] ){
		echo "<font color=red>All feilds are required</font>\n";
	}
?>
</body></html>
<?
	exit;
}
// connect to the mysql server
$link = mysql_connect($server, $db_user, $db_pass)
or die ("Could not connect to mysql because ".mysql_error());

// select the database
mysql_select_db($database)
or die ("Could not select database because ".mysql_error());

// check if the username is taken
$check = "select user_name from $table where user_name = '".$username."';"; 
$qry = mysql_query($check) or die ("Could not match data because ".mysql_error());
$num_rows = mysql_num_rows($qry); 
if ($num_rows != 0) { 
echo "Sorry, there the username $username is already taken.<br>";
echo "<a href=register.html>Try again</a>";
exit; 
} else {

// insert the data
	$insert = mysql_query("INSERT INTO $table ".
		"(ID,user_name,user_passwd,user_group,user_salt,user_email)".
		" VALUES ('','".$username."', ENCRYPT('".$password."',ENCRYPT('".$username."','aorta')),NULL,ENCRYPT('".$username."','aorta'),'".$emailadr."');")
or die("Could not insert data because ".mysql_error());

echo "<pre>TEST: $username $password $emailadr $num_rows</pre><br>";

// print a success message
echo "Your user account has been created!<br>"; 
echo "Now you can <a href=login.html>log in</a>"; 
}

?>
