Comparing passwords in php and sending it to a database -

i making login in page , beginner programmer need know function compare passwords if not match tell user dont match , need encrypt them sent database

thank you

this have far:

<?php  $firstname = $_post['firstname']; $lastname = $_post['lastname']; $email = $_post['email']; $password = $_post['password']; $password2 = $_post['password2'];  if ($&&$password&&$email&&$firstname&&$lastname) {  if int strcmp ( string $password , string $password2 ) {  $connect = mysql_connect("localhost","root","power1") or die("couldn't connect!"); mysql_select_db("members") or die ("couldnt find db!");  insert users (firstname, lastname, email, password,...) values ($firstname, $lastname, $email, $password, $password2,...)  } else     die("your passswords not match")   } else     die("please enter credentials");  ?> 

i think great came here ask , love you've dived want do.

<?php  $firstname = $_post['firstname']; $lastname = $_post['lastname']; $email = $_post['email']; $password = $_post['password']; $password2 = $_post['password2']; 

so far, great. you've created variables, such $firstname, easier read , type $_post['firstname']. many php programmers this.

what have careful of, though, nothing guaranteed exist in $_post array. therefore, things $_post['firstname'] can undefined. reason, have test desired values exist first.

if ($&&$password&&$email&&$firstname&&$lastname) { 

i believe here wanted test post values exist. unfortunately, late, error have occurred above. should consider starting program in fashion.

<?php  if (isset($_post['firstname']) && isset($_post['lastname'])  && isset($_post['email'])     && isset($_post['password'])  && isset($_post['password2'])) {     $firstname = $_post['firstname'];     $lastname = $_post['lastname'];     $email = $_post['email'];     $password = $_post['password'];     $password2 = $_post['password2'];      // rest of script... } 

in example, make sure of post values want use exist before start using them. example not encounter errors if post values missing.

if int strcmp ( string $password , string $password2 ) { 

you have right idea, not need use strcmp compare 2 strings equality in php. instead, may use == operator.

if ($password == $password2) { 

if wanted use strcmp, can learn documentation page http://php.net/strcmp function returns 0 if strings equal. therefore, use this.

if (strcmp($password, $password2) == 0) { 

after you've made sure passwords match, when you'd want hash password. note hashing different encryption: hashing one-way, meaning once password hashed cannot take hash code , password; on other hand, encryption can reversed. because never-ever want bad guys know someone's password is, should hash password rather encrypt it.

of course, strength of hash hashing algorithm, , there many available. sha1 decently strong , fine use until more comfortable programming.

$password_hash = sha1($password); 

you've connected database perfectly. nothing wrong here.

$connect = mysql_connect("localhost","root","power1") or die("couldn't connect!"); mysql_select_db("members") or die ("couldnt find db!"); 

however, there particular way in need query database.

insert users (firstname, lastname, email, password,...) values ($firstname, $lastname, $email, $password, $password2,...) 

this query needs given database passing string mysql_query function.

$sql_firstname = mysql_real_escape_string($firstname); $sql_lastname = mysql_real_escape_string($lastname); $sql_email = mysql_real_escape_string($email); $sql_password_hash = mysql_real_escape_string($password_hash);  $sql = "insert users (firstname, lastname, email, password)"       ."`values ('$sql_firstname', '$sql_lastname', '$sql_email', '$sql_password_hash')";  mysql_query($sql); 

note couple things. first of all, storing $password_hash in database instead of $password. want, never want bad guys hack database , figure out people's passwords are. secondly, notice not construct sql string using $firstname directly; instead, use $sql_firstname, equivalent $firstname has had special characters escaped -- mysql_real_escape_string function does. vital securing against sql injection attacks, recommend reading on: http://php.net/manual/en/security.database.sql-injection.php.

} else     die("your passswords not match")   } else     die("please enter credentials"); 

the rest of program done well; deliberately handle these possible error cases. make sure continue consider possibilities , deal each 1 appropriately; doing prevent unknown bugs , security vulnerabilities in code.