Question

I tried to get the user_id from the decoded data.
As seen below, the same thing is done with algorithm.
Problem is, when registering, the user_id field in the database is empty so it doesn’t really work.

What have I done wrong?
Facebook link: https://developers.facebook.com/docs/plugins/registration/
This is my process php.

<?php
define('FACEBOOK_APP_ID', ''); // Place your App Id here
define('FACEBOOK_SECRET', ''); // Place your App Secret Here

// No need to change the function body
function parse_signed_request($signed_request, $secret) 
{
list($encoded_sig, $payload) = explode('.', $signed_request, 2);
// decode the data
$sig = base64_url_decode($encoded_sig);
$data = json_decode(base64_url_decode($payload), true);
if (strtoupper($data['algorithm']) !== 'HMAC-SHA256')
{
error_log('Unknown algorithm. Expected HMAC-SHA256');
return null;
}
$user_fbid = $data['user_id'];

// check sig
$expected_sig = hash_hmac('sha256', $payload, $secret, $raw = true);
if ($sig !== $expected_sig) 
{
error_log('Bad Signed JSON signature!');
return null;
}
return $data;
}
function base64_url_decode($input) 
{
return base64_decode(strtr($input, '-_', '+/'));
}
if ($_REQUEST) 
{
$response = parse_signed_request($_REQUEST['signed_request'],
FACEBOOK_SECRET);

$name = $response["registration"]["name"];
$email = $response["registration"]["email"];
$password = $response["registration"]["password"];
$gender = $response["registration"]["gender"];
$dob = $response["registration"]["birthday"];

// Connecting to database
mysql_connect("", "", "")or die("cannot connect");
mysql_select_db("")or die("cannot select DB");

// Inserting into users table
$result = mysql_query("INSERT INTO `users` (`fullname`, `email`, `password`, `gender`, `dob`, `user_id`) VALUES ('$name', '$email', '$password', '$gender', '$dob', '$user_fbid')");

if($result){
// User successfully stored
}
else
{
// Error in storing
}
}
else 
{
echo '$_REQUEST is empty';
}
?>

Answer 1

You define $user_fbid in the parse_signed_request()-function and then output it outside the function when it’s not in scope anymore 🙂

But with $response = parse_signed_request($_REQUEST['signed_request'],
FACEBOOK_SECRET); you return the $data-array, where the user_id is in, to $response and then you can access it from there.