Can't insert record into Access Database

[Zuggy]

I'm trying to create a registration/login script using Access 2003. I'm using ADOdb to connect through ODBC.

[CODE=php]<?php
// Connects to your Database
include('adodb/adodb.inc.php') ; # load code common to ADOdb
$db = &ADONewConnecti on('access'); # create a connection
$db->PConnect('evdb '); # connect to MS-Access, evdb DSN
$db->debug = true;

//This code runs if the form has been submitted
if (isset($_POST['submit'])) {

//This makes sure they did not leave any fields blank
if (!$_POST['username'] | !$_POST['pass'] | !$_POST['pass2'] ) {
die('You did not complete all of the required fields, <a href="reg.php"> Return</a>');
}

// checks if the username is in use
if (!get_magic_quo tes_gpc()) {
$_POST['username'] = addslashes($_PO ST['username']);
}
$usercheck = $_POST['username'];
$check = $db->GetRow("SELE CT user.username FROM [user] WHERE username = '$usercheck'")
or die('<b>Could Not Connect to Server</b>');
$check2 = count($check);


//if the name exists it gives an error
if ($check2 != 0) {
die('Sorry, the username '.$_POST['username'].' is already in use.');
}

// this makes sure both passwords entered match
if ($_POST['pass'] != $_POST['pass2']) {
die('Your passwords did not match.');
}

// here we encrypt the password and add slashes if needed
$_POST['pass'] = md5($_POST['pass']);
if (!get_magic_quo tes_gpc()) {
$_POST['pass'] = addslashes($_PO ST['pass']);
$_POST['username'] = addslashes($_PO ST['username']);
}

// now we insert it into the database
$insert = "INSERT INTO user ( username, password )
VALUES ('".$_POST['username']."','".$_POS T['pass']."')";
//echo $insert;
$add_member = $db->Execute($inser t);
?>
[/CODE]
The problem is that I get the little custom error Could Not Connect to Server when I try to insert a record, yet when I use the form with a username I inserted through Access it reads it just fine and returns if the username has been used. Also if I removed line line 23 (the one with the error) and it'll complete the script, but it won't insert the record.

[ronnil]

I'm sorry, I do not have an answer to your question, but i discovered a bug in your code, which could make you pull your hair out later on.

Personally i consider tampering with the global variables of php bad coding practice, and this proves why:

at line 17-18 you check if magic quotes is on (which is a good thing), but then you set the $_POST['username'] = something

[CODE=php]if (!get_magic_quo tes_gpc()) {
$_POST['username'] = addslashes($_PO ST['username']);
}[/CODE]
at line 38-41 you put this code. This time, you give addslashes an already escaped string, forcing it to do double escaping:

[CODE=php]if (!get_magic_quo tes_gpc()) {
$_POST['pass'] = addslashes($_PO ST['pass']);
$_POST['username'] = addslashes($_PO ST['username']);
}[/CODE]
The result is, that if magic_quotes_gp c is off, you will put in a double escaped string into the database, whilst only checking the username with a single escaped string.

In other words, with magic quotes off, you will never trigger the "username exists" part. (unless your database is too smart for it's own good, since you should be knowing what you're doing), say we post a string like

I'mthegreatest

your script will search for:
I\'mthegreatest

and then it will insert
I\\'mthegreates t

This can be avoided by setting another variable as the placeholder. for instance:

[CODE=php]if(!get_magic_q uotes_gpc())
{
$username = addslashes($_PO ST['username']);
} else {
$username = $_POST['username']
}
[/CODE]
This, in worst case scenario, assigns a new value to the $username, so if make this action two times in a row, you still get the same result.

And you might as well instantiate all the variables at once (giving a minimal perfomance increase i guess :P)

This could actually also prove to be the solution, depending on what goes on inside $db->Execute, but I'm pretty certain it won't.

either case... never ever tamper with your original data, make a copy and play around with that.

Hope this helps someway around :)