Question

Here is the function that registers a user depending on what the user entered into the form.

function register($firstname, $lastname , $email, $password, $password2){
      // check if the first password is allowed
      if(!checkLogin($email, $password)){
         echo "checklogin failed";
         return false;  
     }

         // check if two passwords are equal
     if(strcmp($password, $password2) != 0){
         echo "passwords rent the same";
         return false;
     }

     // explode the email into two pieces
     $email = explode('@' , $email);
     echo "" . $email[0] . " and " . $email[1] . "";
     $insertemail = "$email[0]-" . "$email[1]";
     echo "" . $insertemail . "";

     // connect to database and insert values
     require("db.inc.php");
     $query = "INSERT into users set 
        firstname = ".mysqli_real_escape_string($link, $firstname) ." ,
        lastname = ".mysqli_real_escape_string($link, $lastname) ." ,
        email = ".mysqli_real_escape_string($link, $insertemail) ." ,
        password = ".mysqli_real_escape_string($link, $password) ." ";
     $result = mysqli_query($link, $query)
            or die("Error: " . mysqli_error($link));
     // check the query worked
     if(!result){
         return false;
     }

     return true;

 }

I’m not sure if this helps but the ‘Connor’ value was the value I entered into the form and is stored in $firstname.

Answer 1

You need to surround text values with quotes in your SQL query, not to mention your INSERT syntax is a bit off:

 $query = "INSERT INTO users (firstname, lastname, email, password) VALUES 
           ( 
              '" . mysqli_real_escape_string($link, $firstname)   . "' ,
              '" . mysqli_real_escape_string($link, $lastname)    . "' ,
              '" . mysqli_real_escape_string($link, $insertemail) . "' ,
              '" . mysqli_real_escape_string($link, $password)    . "' 
           ) ";