<?php

require_once dir(__FILE__) . '/../db.php';

//get username and password info from the form, protecting against SQL injection
$pass = mysql_real_escape_string($_POST["pass"]);
$confirm = mysql_real_escape_string($_POST["confirm"]);
$user = mysql_real_escape_string($_POST["name"]);

//validate user input
if(!preg_match('/^[a-zA-Z0-9]{5,20}$/',$user)) {
die ('Error: Usernames can only contain alphanumeric characters and must be between 5 and 20 characters in length.');
}

if(!preg_match('/^[a-zA-Z0-9]{5,20}$/',$pass)) {
die('Error: Passwords can only contain alphanumeric characters and must be between 5 and 20 characters in length.');
}

if($pass != $confirm) {
die('Error: Passwords do not match.');
}

//make sure user doesn't already exist and if it doesn't, add new record to the database
$result = mysql_query("SELECT login FROM accounts WHERE login='$user'");

if(mysql_num_rows($result)>0) {
die ('Error: Username already exists.');
}else{
mysql_query("INSERT INTO accounts (login, password, accessLevel) VALUES ('".$_POST['name']."', '".base64_encode(pack('H*', sha1($_POST['pass'])))."', 0)")
or die ('Error: ' . mysql_error());
}

//report successful registration
echo "Account created successfully.";

//close MySQL connection
mysql_close();

?>