Question

I am creating an Android application that has a login/registration page. To be able to use the application, the user must be 21 + years old. I have previously created php files for login, register, and update user info. I am having trouble on where to add code that will check if the user is 21+ into the update_user_info.php file I have created.

I have figured out the correct mysql command to add to the php file, I am just not sure how or where to add the command into the php file. I need to use the timestampdiff function to find the difference between the dob entered and the curdate, then to check if the user entry is over 21 years old.

Here is the code for my register.php

<?php

require_once 'update_user_info.php';
$db = new update_user_info();

// json response array
$response = array("error" => FALSE);

if (isset($_POST['name']) && isset($_POST['email']) && 
isset($_POST['password']) && isset($_POST['gender']) && 
isset($_POST['dob'])) {

    // receiving the post params
    $name = $_POST['name'];
    $email = $_POST['email'];
    $password = $_POST['password'];
    $gender = $_POST['gender'];
    $dob = $_POST['dob'];

    // check if user is already existed with the same email
    if ($db->CheckExistingUser($email)) {
        // user already existed
        $response["error"] = TRUE;
        $response["error_msg"] = "User already existed with " . $email;
        echo json_encode($response);
    } else {
        // create a new user
        $user = $db->StoreUserInfo($name, $email, $password, $gender, 
$dob);
        if ($user) {
            // user stored successfully
            $response["error"] = FALSE;
            $response["user"]["name"] = $user["name"];
            $response["user"]["email"] = $user["email"];
            $response["user"]["gender"] = $user["gender"];
            $response["user"]["dob"] = $user["dob"];
            echo json_encode($response);
        } else {
            // user failed to store
            $response["error"] = TRUE;
            $response["error_msg"] = "Unknown error occurred in 
registration!";
            echo json_encode($response);
        }
}
} else {
    $response["error"] = TRUE;
    $response["error_msg"] = "Required parameters (name, email, password, 
gender or date of birth) is missing!";
    echo json_encode($response);
}
?>

Here is the code for update_user_info.php

<?php

class update_user_info {

    private $conn;

    // constructor
    function __construct() {
        require_once 'android_login_connect.php';
        // connecting to database
        $db = new android_login_connect();
        $this->conn = $db->connect();
    }

    // destructor
    function __destruct() {

    }

    /**
     * Storing new user
     * returns user details
     */
    public function StoreUserInfo($name, $email, $password, $gender, $dob) 
{
        $hash = $this->hashFunction($password);
        $encrypted_password = $hash["encrypted"]; // encrypted password
        $salt = $hash["salt"]; // salt

        $stmt = $this->conn->prepare("INSERT INTO beerpressure_users(name, 
email, encrypted_password, salt, gender, dob) VALUES(?, ?, ?, ?, ?, ?)");
        $stmt->bind_param("ssssss", $name, $email, $encrypted_password, 
$salt, $gender, $dob);
        $result = $stmt->execute();
        $stmt->close();

        // check for successful store
        if ($result) {
            $stmt = $this->conn->prepare("SELECT name, email, 
encrypted_password, salt, gender, dob FROM beerpressure_users WHERE email 
= ?");
            $stmt->bind_param("s", $email);
            $stmt->execute();
            $stmt-> 
bind_result($token2,$token3,$token4,$token5,$token6,$token7);
            while ( $stmt-> fetch() ) {
               $user["name"] = $token2;
               $user["email"] = $token3;
               $user["gender"] = $token6;
               $user["dob"] = $token7;
            }
            $stmt->close();
            return $user;
        } else {
          return false;
        }
    }

    /**
     * Get user by email and password
     */
    public function VerifyUserAuthentication($email, $password) {

        $stmt = $this->conn->prepare("SELECT name, email, 
encrypted_password, salt, gender, dob FROM beerpressure_users WHERE email 
= ?");

        $stmt->bind_param("s", $email);

        if ($stmt->execute()) {
            $stmt-> 
bind_result($token2,$token3,$token4,$token5,$token6,$token7);

            while ( $stmt-> fetch() ) {
               $user["name"] = $token2;
               $user["email"] = $token3;
               $user["encrypted_password"] = $token4;
               $user["salt"] = $token5;
               $user["gender"] = $token6;
               $user["dob"] = $token7;
            }

            $stmt->close();

            // verifying user password
            $salt = $token5;
            $encrypted_password = $token4;
            $hash = $this->CheckHashFunction($salt, $password);
            // check for password equality
            if ($encrypted_password == $hash) {
                // user authentication details are correct
                return $user;
            }
        } else {
            return NULL;
        }
    }

    /**
     * Check user is existed or not
     */
    public function CheckExistingUser($email) {
        $stmt = $this->conn->prepare("SELECT email from beerpressure_users 
WHERE email = ?");

        $stmt->bind_param("s", $email);

        $stmt->execute();

        $stmt->store_result();

        if ($stmt->num_rows > 0) {
            // user existed 
            $stmt->close();
            return true;
        } else {
            // user not existed
            $stmt->close();
            return false;
        }
    }

    /**
     * Encrypting password
     * @param password
     * returns salt and encrypted password
     */
    public function hashFunction($password) {

        $salt = sha1(rand());
        $salt = substr($salt, 0, 10);
        $encrypted = base64_encode(sha1($password . $salt, true) . $salt);
        $hash = array("salt" => $salt, "encrypted" => $encrypted);
        return $hash;
    }

    /**
     * Decrypting password
     * @param salt, password
     * returns hash string
     */
    public function checkHashFunction($salt, $password) {
        $hash = base64_encode(sha1($password . $salt, true) . $salt);
        return $hash;
    }

}

?>

Answer 1

update code:

<?php

require_once 'update_user_info.php';
$db = new update_user_info();

// json response array
$response = array("error" => FALSE);

if (isset($_POST['name']) && isset($_POST['email']) &&
isset($_POST['password']) && isset($_POST['gender']) &&
isset($_POST['dob'])) {

// receiving the post params
$name = $_POST['name'];
$email = $_POST['email'];
$password = $_POST['password'];
$gender = $_POST['gender'];
$dob = $_POST['dob'];

// check if user is already existed with the same email
if ($db->CheckExistingUser($email)) {
// user already existed
$response["error"] = TRUE;
$response["error_msg"] = "User already existed with " . $email;
echo json_encode($response);
}else if ($db->checkDateofBirth($dob)) { //check dob is greater than 21 or not
// user already existed
$response["error"] = TRUE;
$response["error_msg"] = $dob. " :Date of birth is not greater than 21";
echo json_encode($response);
}else {
// create a new user
$user = $db->StoreUserInfo($name, $email, $password, $gender,
$dob);
if ($user) {
// user stored successfully
$response["error"] = FALSE;
$response["user"]["name"] = $user["name"];
$response["user"]["email"] = $user["email"];
$response["user"]["gender"] = $user["gender"];
$response["user"]["dob"] = $user["dob"];
echo json_encode($response);
} else {
// user failed to store
$response["error"] = TRUE;
$response["error_msg"] = "Unknown error occurred in
registration!";
echo json_encode($response);
}
}
} else {
$response["error"] = TRUE;
$response["error_msg"] = "Required parameters (name, email, password,
gender or date of birth) is missing!";
echo json_encode($response);
}
?>
Here is the code for update_user_info.php

<?php

class update_user_info {

private $conn;

// constructor
function __construct() {
require_once 'android_login_connect.php';
// connecting to database
$db = new android_login_connect();
$this->conn = $db->connect();
}

// destructor
function __destruct() {

}

/**
* Storing new user
* returns user details
*/
public function StoreUserInfo($name, $email, $password, $gender, $dob)
{
$hash = $this->hashFunction($password);
$encrypted_password = $hash["encrypted"]; // encrypted password
$salt = $hash["salt"]; // salt

$stmt = $this->conn->prepare("INSERT INTO beerpressure_users(name,
email, encrypted_password, salt, gender, dob) VALUES(?, ?, ?, ?, ?, ?)");
$stmt->bind_param("ssssss", $name, $email, $encrypted_password,
$salt, $gender, $dob);
$result = $stmt->execute();
$stmt->close();

// check for successful store
if ($result) {
$stmt = $this->conn->prepare("SELECT name, email,
encrypted_password, salt, gender, dob FROM beerpressure_users WHERE email
= ?");
$stmt->bind_param("s", $email);
$stmt->execute();
$stmt->
bind_result($token2,$token3,$token4,$token5,$token6,$token7);
while ( $stmt-> fetch() ) {
$user["name"] = $token2;
$user["email"] = $token3;
$user["gender"] = $token6;
$user["dob"] = $token7;
}
$stmt->close();
return $user;
} else {
return false;
}
}

/**
* Get user by email and password
*/
public function VerifyUserAuthentication($email, $password) {

$stmt = $this->conn->prepare("SELECT name, email,
encrypted_password, salt, gender, dob FROM beerpressure_users WHERE email
= ?");

$stmt->bind_param("s", $email);

if ($stmt->execute()) {
$stmt->
bind_result($token2,$token3,$token4,$token5,$token6,$token7);

while ( $stmt-> fetch() ) {
$user["name"] = $token2;
$user["email"] = $token3;
$user["encrypted_password"] = $token4;
$user["salt"] = $token5;
$user["gender"] = $token6;
$user["dob"] = $token7;
}

$stmt->close();

// verifying user password
$salt = $token5;
$encrypted_password = $token4;
$hash = $this->CheckHashFunction($salt, $password);
// check for password equality
if ($encrypted_password == $hash) {
// user authentication details are correct
return $user;
}
} else {
return NULL;
}
}

/**
* Check user is existed or not
*/
public function CheckExistingUser($email) {
$stmt = $this->conn->prepare("SELECT email from beerpressure_users
WHERE email = ?");

$stmt->bind_param("s", $email);

$stmt->execute();

$stmt->store_result();

if ($stmt->num_rows > 0) {
// user existed
$stmt->close();
return true;
} else {
// user not existed
$stmt->close();
return false;
}
}
   /* *
   *Check date of birth
   */
   public function checkDateofBirth($userdob) {

       //Create a DateTime object using the user's date of birth.
       $dob = new DateTime($userDob);

       //We need to compare the user's date of birth with today's date.
       $now = new DateTime();

       //Calculate the time difference between the two dates.
       $difference = $now->diff($dob);

       //Get the difference in years, as we are looking for the user's age.
       $age = $difference->y;
       if($age>21){
           return false;
       }
       return true;
}

/**
* Encrypting password
* @param password
* returns salt and encrypted password
*/
public function hashFunction($password) {

$salt = sha1(rand());
$salt = substr($salt, 0, 10);
$encrypted = base64_encode(sha1($password . $salt, true) . $salt);
$hash = array("salt" => $salt, "encrypted" => $encrypted);
return $hash;
}

/**
* Decrypting password
* @param salt, password
* returns hash string
*/
public function checkHashFunction($salt, $password) {
$hash = base64_encode(sha1($password . $salt, true) . $salt);
return $hash;
}

}

?>

write age check before updating or insert user details into sql table.

So after check the user is existing or not then check for the dob is valid or not.