为什么我的全局变量不起作用？

Question

I am trying to create a signup form that allows potential users to input their first and last name, a username and a password. With this password, I want to use PHP's hash function and some "salts" to make the password secure. To do so, I created a function inside my PHP script to save on redundancy. To accomplish this, I changed variables $connection, $iniSalt, and $endSalt to global variables - thinking this would allow me to use them inside the function addUser(). Can someone tell me what I am doing wrong here? Any advice on how to go about this would be greatly appreciated. Here is my code:

global $connection;
$connection = new mysqli($db_host, $user, $pass, $db);

if ($connection->connect_error) {
    die($connection->connect_error);
}

$query = "CREATE TABLE users (
firstname VARCHAR(32) NOT NULL,
lastname VARCHAR(32) NOT NULL,
username VARCHAR(32) NOT NULL UNIQUE,
password VARCHAR(32) NOT NULL
)";

$result = $connection->query($query);
if (!$result) {
    die($connection->error);
}

global $iniSalt, $endSalt;
$iniSalt = "xb&z*";
$endSalt = "nb!@";

function addUser($conn, $firstname, $lastname, $username, $password) {
    $token = hash('ripemd128', "$iniSalt$password$endSalt");
    $query = "INSERT INTO users VALUES('$firstname', '$lastname', '$username', $token)";
    $result = $connection->query($query);
    if (!$result) {
        die($connection->error);
    }
}

addUser($connection, 'Bill', 'Murray', 'bmurray', 'mysecret');
addUser($connection, 'Jacki', 'Hughes', 'jhughes', 'somepw');

Answer 1

Besides the other answers given in regards to the placement of global, and that I also pointed out in comments about its placement:

Sidenote: Consult my footnotes.

The $token variable is a string and it also must be quoted.

$query = "INSERT INTO users VALUES('$firstname', '$lastname', '$username', $token)";

When your query fires up, you will get a syntax error for it.

So, quote the variable:

$query = "INSERT INTO users VALUES('$firstname', '$lastname', '$username', '$token')";

ripemd128 produces a string, not an integer

• http://php.net/manual/en/function.hash.php

ripemd128 32 789d569f08ed7055e94b4289a4195012

Also, if you're planning on going live with this, you'd be better off using password_hash() or the compatibility pack for it.

It's much safer.

References:

• PHP 5.5's password_hash() function.
• Compatibility pack (if PHP < 5.5) https://github.com/ircmaxell/password_compat/

If and when you do decide to use password_hash() or crypt, it is important to note that if your present password column's length is anything lower than 60, it will need to be changed to that (or higher). The manual suggests a length of 255.

You will need to ALTER your column's length and start over with a new hash in order for it to take effect. Otherwise, MySQL will fail silently.

---

Footnotes:

Read up on variable scope:

• http://php.net/manual/en/language.variables.scope.php
• Reference: What is variable scope, which variables are accessible from where and what are "undefined variable" errors?

If you're looking to protect against SQL injection which is something worthwhile doing, consult the following:

• mysqli_ with prepared statements

• PDO with prepared statements.