Another note, this codes stores user passwords in plaintext. Only your 4 digit pin is hashed.
//Test registration information
$act = $_POST["act"];
if($act == "attemptRegister"){
//Valid date all fields
$username = $_POST["user"];
$pass = $_POST["pass"];
$rPass = $_POST["pass2"];
$email = $_POST["email"];
$email2 = $_POST["email2"];
$authPin = (int) $_POST["authPin"];
$validRegister = 1;
//.....
//Validate passwords
if($pass != $rPass){
if(strlen($pass) < 5){
$validRegister = 0;
$returnError .= " | Password is too short";
}else{
$validRegister = 0;
$returnError .= " | Passwords do not match";
}
}
//.....
if($validRegister){
//Add user to webUsers
$emailAuthPin = genRandomString(10);
$secret = genRandomString(10);
connectToDb();
mysql_query("INSERT INTO `xenland_pushpool`.`webUsers` (`admin`, `username`, `pass`, `email`, `emailAuthPin`, `secret`, `loggedIp`, `sessionTimeoutStamp`, `accountLocked`, `accountFailedAttempts`, `pin`)
VALUES ('0', '".$username."', [b]'".$pass."[/b]', '".$email."', '".$emailAuthPin."', '".$secret."', '0', '0', '0', '0', '".[b]hash("sha256", $authPin)[/b]."')");
$goodMessage = "Successfully signed up! You must authorize your account by now logging into your email address of ".$email." and clicking the authorize link";
}
Also, this does nothing. $salt isnt called on any of the hash functions.
//Encrypt settings
$salt = "836483jd7Dg6h5s92k";