Registration, critical error

[cyberdyne2]

The registration process of my gallery is resulting in a critical error. Only registration appears to cause the issue, I'm not experiencing it anywhere else.

Critical error
Script called without the required parameter(s). (username)

Website is -- www.londonallstars.co.uk/gallery

Username is: testing
Password is: testing

Debug mode is enabled.

Any help greatly appreciated.
Thank you.

[Αndré]

Please upgrade to the latest stable release (currently cpg1.5.22) and report if the issue still exists.

[cyberdyne2]

I hadn't done so as the release states it is not essential. I will do so though.
Are you aware that the date for the new update is wrong on the news section?

2011-08-01: cpg1.5.22 has been released. It fixes various issues, so all users of the cpg1.5.x series are encouraged to upgrade. The upgrade is not security-related.

[cyberdyne2]

I am about to upgrade but wanted to add that I just noticed the following in my Coppermine database logs:

While executing query 'SELECT cid FROM cpg_categories WHERE lft BETWEEN AND ' in include/functions.inc.php on line 54 the following error was encountered:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'AND' at line 1

[Αndré]

Are you aware that the date for the new update is wrong on the news section?

Fixed. Thanks.

[cyberdyne2]

OK update. Process seemed to go well but still receiving error on registration:

Critical error
Script called without the required parameter(s). (username)

File: [removed]/gallery/register.php - Line: 460

Site details remain as above.

[Αndré]

Please open register.php, find

Code Select Expand

$user_name = trim(get_post_var('username'));
and above, add

Code Select Expand

print_r($superCage->post->_source);print_r(trim($superCage->post->getEscaped('username')));pagefooter();die();

This won't fix your issue but prints the content of POST data. After you confirm to you have applied the change I'll try again to register in your gallery to see the new output.

[cyberdyne2]

Change made.

My output after the change was:

Code Select Expand

Array ( [username] => NewUser [password] => password [password_verification] => password [email] => test@fu.fu [user_profile1] => none [user_profile2] => none [agree] => 1 [confirmCode] => WPTRE [submit] => Submit registration )

[Αndré]

Please replace the new line with

Code Select Expand

print_r($superCage->post->_source);print_r($superCage->post->getRaw('username'));pagefooter();die();

[cyberdyne2]

Please replace the new line with

Code Select Expand

print_r($superCage->post->_source);print_r($superCage->post->getRaw('username'));pagefooter();die();

Done.

[Αndré]

It seems that there's an issue with the getEscaped method, the trim function or their combination.

Please replace the new line one more time with the following lines:

Code Select Expand

    echo "<hr />trim(getEscaped): ";print_r(trim($superCage->post->getEscaped('username')));
    echo "<hr />getEscaped: ";print_r($superCage->post->getEscaped('username'));
    echo "<hr />trim(getRaw): ";print_r(trim($superCage->post->getRaw('username')));
    echo "<hr />getRaw: ";print_r($superCage->post->getRaw('username'));
    echo "<hr />";pagefooter();die();

[cyberdyne2]

Please replace the new line one more time with the following lines:

Code Select Expand

    echo "<hr />trim(getEscaped): ";print_r(trim($superCage->post->getEscaped('username')));
    echo "<hr />getEscaped: ";print_r($superCage->post->getEscaped('username'));
    echo "<hr />trim(getRaw): ";print_r(trim($superCage->post->getRaw('username')));
    echo "<hr />getRaw: ";print_r($superCage->post->getRaw('username'));
    echo "<hr />";pagefooter();die();

Done.
Thank you for your time André

[Αndré]

Output is

trim(getEscaped):
getEscaped:
trim(getRaw): André
getRaw: André

which means that the getEscaped function doesn't work for you. It does basically

Code Select Expand

return mysql_real_escape_string(htmlspecialchars($value, ENT_QUOTES));
so lets try to figure out what exactly is wrong.

Updated code:

Code Select Expand

    $_POST = $superCage->post->_source;
    echo "<hr />mysql_real_escape_string(htmlspecialchars({$_POST['username']}, ENT_QUOTES)): ".mysql_real_escape_string(htmlspecialchars($_POST['username'], ENT_QUOTES));
    echo "<hr />htmlspecialchars({$_POST['username']}, ENT_QUOTES): ".htmlspecialchars($_POST['username'], ENT_QUOTES);
    echo "<hr />htmlspecialchars({$_POST['username']}): ".htmlspecialchars($_POST['username']);
    echo "<hr />mysql_real_escape_string({$_POST['username']}): ".mysql_real_escape_string($_POST['username']);
    echo "<hr />";pagefooter();die();

[cyberdyne2]

Updated code:

Code Select Expand

    $_POST = $superCage->post->_source;
    echo "<hr />mysql_real_escape_string(htmlspecialchars({$_POST['username']}, ENT_QUOTES)): ".mysql_real_escape_string(htmlspecialchars($_POST['username'], ENT_QUOTES));
    echo "<hr />htmlspecialchars({$_POST['username']}, ENT_QUOTES): ".htmlspecialchars($_POST['username'], ENT_QUOTES);
    echo "<hr />htmlspecialchars({$_POST['username']}): ".htmlspecialchars($_POST['username']);
    echo "<hr />mysql_real_escape_string({$_POST['username']}): ".mysql_real_escape_string($_POST['username']);
    echo "<hr />";pagefooter();die();

I got the same results.
Update done.

[Αndré]

mysql_real_escape_string(htmlspecialchars(André, ENT_QUOTES)):
htmlspecialchars(André, ENT_QUOTES): André
htmlspecialchars(André): André
mysql_real_escape_string(André):

If we don't use mysql_real_escape_string it works as expected. What's your PHP version? Do you find anything at the phpinfo about that function?

[cyberdyne2]

If we don't use mysql_real_escape_string it works as expected. What's your PHP version?

PHP Version 5.2.9

Do you find anything at the phpinfo about that function?

Nothing found relating to that, no. I will look again but a search found nothing.

[cyberdyne2]

Can I PM you a link to a php info page ?

[Αndré]

Can I PM you a link to a php info page ?

I'll send you my contact details directly after this post. But as I'm not sure if I'll find anything helpful, please also ask your hosting provider what could be wrong with that function in the meanwhile.

[cyberdyne2]

OK, will do. Thank you André

[cyberdyne2]

Does this help? I don't know enough about MySql / PHP to know if this alternative code would make a difference.
Thank you.

Put mysql_connect("host", "user", "pass") or die('save_failed'); before mysql_real_escape_string.

http://stackoverflow.com/questions/7803522/mysql-real-escape-string-works-in-localhost-but-not-on-webserver