File: /home/awaldron/www/archive/demo/register.php
<?php
session_start();
include("_functions.php");
dbconnect();
$page_title = "User Registration";
$GLOBALS["ext_page"] = $page_title; // SET FAUX PAGE NAME
$_GET["p"] = 1; // SET FAUX PARENT ID
$lnav_mods = array();
$rnav_mods = array();
include("_pagestart.php");
$reg_method = REG_METHOD;
if ($reg_method != "admin") {
$submitted = FALSE;
if (isset($_POST["submit_new"])) {
$exec_sql = TRUE;
$errors = "<P><span style=\"color:DD0000\"><b>Your registration could not be submitted due to the following errors:</b><ul>\n";
// Make sure all values contain allowed characters
while (list($key, $value) = each($_POST)) if (!preg_match("/^[^=%\"<>()]*$/i", $value)) { $exec_sql = FALSE; $errors .= "<li> Invalid characters used in text fields. Invalid characters include ( , = , % , > , < , \" , )\n"; }
// Check if username already exists
if (quickSQL("SELECT COUNT(username) FROM tbl_employees WHERE username='".$_POST["username"]."'")>0?TRUE:FALSE) { $exec_sql = FALSE; $errors .= "<li> Username already exists.\n"; }
// Check if passwords match
if (strcmp($_POST["password"],$_POST["confirm_password"]) != 0) { $exec_sql = FALSE; $errors .= "<li> Your passwords do not match.\n"; }
// Check required fields
if (trim(str_replace(" ","",$_POST["username"])) == "") { $exec_sql = FALSE; $errors .= "<li> Username is a required field.\n"; }
if ((trim(str_replace(" ","",$_POST["password"])) == "") || (trim(str_replace(" ","",$_POST["confirm_password"]) == ""))) { $exec_sql = FALSE; $errors .= "<li> Password is a required field.\n"; }
if (trim(str_replace(" ","",$_POST["fname"])) == "") { $exec_sql = FALSE; $errors .= "<li> First Name is a required field.\n"; }
if (trim(str_replace(" ","",$_POST["lname"])) == "") { $exec_sql = FALSE; $errors .= "<li> Last Name is a required field.\n"; }
if (trim(str_replace(" ","",$_POST["title"])) == "") { $exec_sql = FALSE; $errors .= "<li> Job Title is a required field.\n"; }
if (trim(str_replace(" ","",$_POST["email"])) == "") { $exec_sql = FALSE; $errors .= "<li> Email Address is a required field.\n"; }
if (trim(str_replace(" ","",$_POST["ph_direct"])) == "") { $exec_sql = FALSE; $errors .= "<li> Direct Phone is a required field.\n"; }
// Check for Valid Email
if (!preg_match("/^[A-Z0-9._%-]+@[A-Z0-9._%-]+\.[A-Z]{2,6}$/i", $_POST["email"])) { $exec_sql = FALSE; $errors .= "<li> Invalid email address.\n"; }
if ($exec_sql) {
// Generate Email Verification Number
$vstr = str_random(8);
$sql = "INSERT INTO tbl_employees (username,password,fname,lname,title,emp_type_id,manager,start_date,birthday,email,ph_direct,ph_remote_office,ph_remote_fax,ph_cell,ph_home,location,acct_created,last_updated,acct_key,email_confirmed,acct_confirmed) VALUES (";
$sql .= "'".$_POST["username"]."',";
$sql .= "'".md5($_POST["password"])."',";
$sql .= "'".$_POST["fname"]."',";
$sql .= "'".$_POST["lname"]."',";
$sql .= "'".$_POST["title"]."',";
$sql .= $_POST["emp_type_id"].",";
$sql .= "'".$_POST["manager"]."',";
$sql .= "'".$_POST["sdyear"].$_POST["sdmon"].$_POST["sdday"]."000000',";
$sql .= "'".$_POST["bmon"].$_POST["bday"]."',";
$sql .= "'".$_POST["email"]."',";
$sql .= "'".$_POST["ph_direct"]."',";
$sql .= "'".$_POST["ph_remote_office"]."',";
$sql .= "'".$_POST["ph_remote_fax"]."',";
$sql .= "'".$_POST["ph_cell"]."',";
$sql .= "'".$_POST["ph_home"]."',";
$sql .= "'".$_POST["location"]."',";
$sql .= time().",";
$sql .= time().",";
$sql .= "'".$vstr."',";
$sql .= "0,0)";
$res = mysql_query($sql);
if ($res > 0) {
$submitted = TRUE;
quickUPDATE("INSERT INTO tbl_group_user (username,group_id) VALUES ('".$_POST["username"]."',".$_POST["group_id"].")");
}
else { $exec_sql = FALSE; $errors .= "<li> A database error occurred, your registration was not successful.\n"; }
}
$errors .= "</ul></span>\n";
}
if ($submitted) {
// Send Validation Email
$message = "Hello, ".$_POST["fname"]." ".$_POST["lname"]."\n\n";
$message .= "You are receiving this email because you have (or someone pretending to be you has) requested new account registration for the ".CMP_NAME_INF." Intranet. If you did not request this email then please ignore it, if you keep receiving it please contact the Intranet Administrator.\n\n";
$message .= "Please keep this email for your records. Your account information is as follows:\n\n";
$message .= "-----------------------------\n";
$message .= "Username: ".$_POST["username"]."\n";
$message .= "Password: ".$_POST["password"]."\n";
$message .= "-----------------------------\n\n";
$message .= "Your account is currently inactive. To complete your registration and activate your account, you must first verify your email address by clicking on the URL link provided below. If the URL is not highlighted and underlined as a link, copy and paste the URL, between the dotted lines below, into your browser's address bar.\n\n";
$message .= "http://".DOMAIN."/reg_confirm.php?key=".$vstr."\n\n";
$message .= "Please do not forget your password as it has been encrypted in our database and we cannot retrieve it for you. However, should you forget your password you can request a new one which will be activated in the same way as this account.\n\n";
$message .= "Thank you for registering.\n\n";
$to = $_POST["email"];
$subject = "Welcome to the ".CMP_NAME_INF." Intranet";
$additional_headers = "From: ".CMP_NAME_INF." Intranet <".admin("email").">\n" . "Reply-To: ".admin("email");
mail($to, $subject, $message, $additional_headers);
$ty = "<b>Your Registration has been successfully submitted.</b>";
$ty .= "<P>However, before your can login to your account, you must first confirm your email address by clicking on the URL contained in the email sent to the address you specified.";
echo "<br><br><br><br><center>".$ty."</center><br><br><br><br>";
} else {
echo "<P>Use the form below to register for an intranet account. Please specify a valid email address because you cannot confirm your registration without one.";
if ($reg_method == "open/admin") echo " Upon submission of the form, an intranet administrator will review your registration and either reject or approve it.\n";
if (!$exec_sql) echo $errors;
echo "<center>\n";
echo "<form action=\"register.php\" method=\"post\">\n";
echo "<div style=\"width:25%;border:solid 2px #".COLOR_TBAR.";padding:25px;background:url('gui/disbg.gif');\">\n";
echo "<table><tr><td valign=\"top\">\n";
echo "<table border=0 cellspacing=5>\n";
echo "<tr><td><b style=\"color:#003466;\">Username:</b></td><td><input type=\"text\" maxlength=32 size=35 name=\"username\" value=\"".$_POST["username"]."\"></td></tr>\n";
echo "<tr><td><b style=\"color:#003466;\">Password:</b></td><td><input type=\"password\" maxlength=32 size=35 name=\"password\"></td></tr>\n";
echo "<tr><td><b style=\"color:#003466;\">Retype Password:</b></td><td><input type=\"password\" maxlength=64 size=35 name=\"confirm_password\"></td></tr>\n";
echo "<tr><td colspan=2> </td></tr>\n";
echo "<tr><td><b style=\"color:#003466;\">First Name:</b></td><td><input type=\"text\" maxlength=32 size=35 name=\"fname\" value=\"".$_POST["fname"]."\"></td></tr>\n";
echo "<tr><td><b style=\"color:#003466;\">Last Name:</b></td><td><input type=\"text\" maxlength=32 size=35 name=\"lname\" value=\"".$_POST["lname"]."\"></td></tr>\n";
echo "<tr><td><b style=\"color:#003466;\">Job Title:</b></td><td><input type=\"text\" maxlength=255 size=35 name=\"title\" value=\"".$_POST["title"]."\"></td></tr>\n";
echo "<tr><td colspan=2> </td></tr>\n";
echo "<tr><td><b style=\"color:#003466;\">Employee Type:</b></td><td>\n";
echo "<SELECT name=\"emp_type_id\">\n";
$res2 = mysql_query("SELECT * FROM tbl_emp_types");
echo "<option></option>\n";
for ($i=0; $i < mysql_num_rows($res2); $i++) {
$et = mysql_fetch_array($res2);
echo "<option value=\"".$et["emp_type_id"]."\"".($_POST["emp_type_id"]==$et["emp_type_id"]?" SELECTED":"").">".$et["emp_type"]."</option>\n";
}
echo "</SELECT></td></tr>\n";
echo "<tr><td><b style=\"color:#003466;\">Manager's Name:</b></td><td>\n";
echo "<SELECT name=\"manager\">\n";
$res = mysql_query("SELECT username FROM tbl_employees WHERE is_employee=1 ORDER BY lname ASC");
echo "<option></option>\n";
for ($j=0; $j < mysql_num_rows($res); $j++) {
$manager = mysql_fetch_array($res);
echo "<option value=\"".$manager["username"]."\"".($manager["username"]==$_POST["manager"]?" SELECTED":"").">".get_user($manager["username"],"fullname2")."</option>\n";
}
echo "</SELECT></td></tr>\n";
echo "<tr><td><b style=\"color:#003466;\">Group:</b></td><td>\n";
echo "<SELECT name=\"group_id\">\n";
$group = (isset($_POST["group_id"])?$_POST["group_id"]:DEF_GROUP);
group_select(0,0,$group);
echo "</SELECT></td></tr>\n";
echo "</table>\n";
echo "</td><td width=25><img src=\"/gui/clear.gif\" width=25 height=1></td><td valign=\"top\">\n";
echo "<table border=0 cellspacing=5>\n";
$month = array("","January","February","March","April","May","June","July","August","September","October","November","December");
echo "<tr><td>Your Birthday:</td><td nowrap>\n";
echo "<SELECT name=\"bmon\">\n";
echo "<option></option>\n";
for ($i=1; $i <= 12; $i++) echo "<option value=\"".($i<10?"0".$i:$i)."\"".($_POST["bmon"]==($i<10?"0".$i:$i)?" SELECTED":"").">".$month[$i]."</option>\n";
echo "</select>\n";
echo "<SELECT name=\"bday\">\n";
echo "<option></option>\n";
for ($j=1; $j <= 31; $j++) echo "<option value=\"".($j<10?"0".$j:$j)."\"".($_POST["bday"]==($j<10?"0".$j:$j)?" SELECTED":"").">".($j<10?"0".$j:$j)."</option>\n";
echo "</select>\n";
echo " (age is not calculated)\n";
echo "</td></tr>\n";
echo "<tr><td nowrap><b style=\"color:#003466;\">Employee Since:</b></td><td>\n";
echo "<SELECT name=\"sdmon\">\n";
echo "<option></option>\n";
for ($i=1; $i <= 12; $i++) echo "<option value=\"".($i<10?"0".$i:$i)."\"".($_POST["sdmon"]==($i<10?"0".$i:$i)?" SELECTED":"").">".$month[$i]."</option>\n";
echo "</select>\n";
echo "<SELECT name=\"sdday\">\n";
echo "<option></option>\n";
for ($j=1; $j <= 31; $j++) echo "<option value=\"".($j<10?"0".$j:$j)."\"".($_POST["sdday"]==($j<10?"0".$j:$j)?" SELECTED":"").">".($j<10?"0".$j:$j)."</option>\n";
echo "</select>\n";
echo "<SELECT name=\"sdyear\">\n";
echo "<option></option>\n";
for ($k=1987; $k <= date("Y"); $k++) echo "<option value=\"".$k."\"".($_POST["sdyear"]==$k?" SELECTED":"").">".$k."</option>\n";
echo "</select>\n";
echo "</td></tr>\n";
echo "<tr><td colspan=2> </td></tr>\n";
echo "<tr><td><b style=\"color:#003466;\">Email Address:</b></td><td><input type=\"text\" maxlength=64 size=35 name=\"email\" value=\"".$_POST["email"]."\"></td></tr>\n";
echo "<tr><td><b style=\"color:#003466;\">Direct Phone:</b></td><td><input type=\"text\" maxlength=20 size=35 name=\"ph_direct\" value=\"".$_POST["ph_direct"]."\"></td></tr>\n";
echo "<tr><td>Remote Office:</td><td><input type=\"text\" maxlength=20 size=35 name=\"ph_remote_office\" value=\"".$_POST["ph_remote_office"]."\"></td></tr>\n";
echo "<tr><td>Remote Fax:</td><td><input type=\"text\" maxlength=20 size=35 name=\"ph_remote_fax\" value=\"".$_POST["ph_remote_fax"]."\"></td></tr>\n";
echo "<tr><td>Mobile Phone:</td><td><input type=\"text\" maxlength=20 size=35 name=\"ph_cell\" value=\"".$_POST["ph_cell"]."\"></td></tr>\n";
echo "<tr><td>Home Phone:</td><td><input type=\"text\" maxlength=20 size=35 name=\"ph_home\" value=\"".$_POST["ph_home"]."\"></td></tr>\n";
echo "<tr><td colspan=2> </td></tr>\n";
echo "<tr><td>Office Location:</td><td><input type=\"text\" maxlength=64 size=35 name=\"location\" value=\"".$_POST["location"]."\"></td></tr>\n";
//echo "<tr><td colspan=2>Display this user in Employee Phone Directories? <SELECT name=\"phone_display\"><option value=\"1\" SELECTED>Yes</option><option value=\"0\">No</option></SELECT></td></tr>\n";
echo "<tr><td colspan=2> </td></tr>\n";
echo "</table>\n";
echo "</td></tr></table>\n";
echo "<center><input type=\"submit\" name=\"submit_new\" value=\"Submit Registration\"></center>\n";
echo "</div>\n";
echo "</form>\n";
}
} else {
echo "<br><br><br><br>".error("Registrations for this Intranet are closed and can only be completed by an Intranet Administrator.")."<br><br><br><br>";
}
include("_pageend.php");
?>