MySQL Portfolio Questions

Language: PHP
<?PHP
	//	include "includes/config.php";
 
//$sname = "";
//$init= "";
//$msname= "";
//$errorMessage = "";
//$num_rows = 0;
$Mr = ';Mr';;
$Mrs = ';Mrs';;
$Miss = ';Miss';;
$Ms = ';Ms';;
//$dob = date("Y-m-d H:i:s");
 
 
function quote_smart($value, $handle) {
 
   if (get_magic_quotes_gpc()) {
       $value = stripslashes($value);
   }
 
   if (!is_numeric($value)) {
       $value = "';" . mysql_real_escape_string($value, $handle) . "';";
   }
   return $value;
}
 
if ($_SERVER[';REQUEST_METHOD';] == ';POST';){
 
	//====================================================================
	//	GET THE CHOSEN U AND P, AND CHECK IT FOR DANGEROUS CHARCTERS
	//====================================================================
	$sname = $_POST[';sname';];
	$init = $_POST[';init';];
	$fname = $_POST[';fname';];
	$title= $_POST[';title';];
	$msname= $_POST[';msname';];
	$gen= $_POST[';gen';];
	$lang= $_POST[';lang';];
	/*$idno= $_POST[';idno';];
	$telh= $_POST[';telh';];
	$telw= $_POST[';telw';];
	$cel= $_POST[';cel';];
	$fax= $_POST[';fax';];
	$email= $_POST[';email';];
	$address= $_POST[';address';];
	//$contact_flag = $_POST[';contact_flag ';];*/
 
	$sname = htmlspecialchars($sname);
	$init = htmlspecialchars($init);
	$fname = htmlspecialchars($fname);
	$title = htmlspecialchars($title);
	$msname = htmlspecialchars($msname);
	$gen = htmlspecialchars($gen);
	$lang = htmlspecialchars($lang);
	/*$idno = htmlspecialchars($idno);
	$telh = htmlspecialchars($telh);
	$telw= htmlspecialchars($telw);
	$cel = htmlspecialchars($cel);
	$fax = htmlspecialchars($fax);
	$email = htmlspecialchars($email);
	$address = htmlspecialchars($address);
	$contact_flag  = htmlspecialchars($contact_flag ); 
 */
	//====================================================================
	//	CHECK TO SEE IF U AND P ARE OF THE CORRECT LENGTH
	//	A MALICIOUS USER MIGHT TRY TO PASS A STRING THAT IS TOO LONG
	//	if no errors occur, then $errorMessage will be blank
	//====================================================================
 
	$uLength = strlen($sname);
	$eLength = strlen($init);
 
	if ($uLength >= 3 && $uLength <= 18) {
		$errorMessage = "";
	}
	else {
		$errorMessage = $errorMessage . "Username must be between 3 and 50 characters" . "<BR>";
	}
 
 
 
	if ($eLength >= 1 && $eLength <= 18) {
		$errorMessage = "";
	}
	else {
		$errorMessage = $errorMessage . "Password must be between 8 and 16 characters" . "<BR>";
	}
 
 
//test to see if $errorMessage is blank
//if it is, then we can go ahead with the rest of the code
//if it';s not, we can display the error
 
	//====================================================================
	//	Write to the database
	//====================================================================
	if ($errorMessage == "") {
 
	$user_name = "root";
	$pass_word = "";
	$database = "registration";
	$server = "127.0.0.1";
 
	$db_handle = mysql_connect($server, $user_name, $pass_word);
	$db_found = mysql_select_db($database, $db_handle);
 
	if ($db_found) {
 
		$sname = quote_smart($sname, $db_handle);
		$init= quote_smart($init, $db_handle);
		$fname= quote_smart($fname, $db_handle);
		$title= quote_smart($title, $db_handle);
  	    $msname= quote_smart($msname, $db_handle);
		$gen= quote_smart($gen, $db_handle);
 
		/*$address= quote_smart($address, $db_handle);
		$email= quote_smart($email, $db_handle);
		$fax= quote_smart($fax, $db_handle);
		$cel= quote_smart($cel, $db_handle);
		$telw= quote_smart($telw, $db_handle);
		$cel= quote_smart($cel, $db_handle);
		$fax= quote_smart($fax, $db_handle);
		$email= quote_smart($email, $db_handle);
		$address= quote_smart($address, $db_handle);
		$contact_flag = quote_smart($contact_flag , $db_handle);*/
 
 
 
 
 
	//====================================================================
	//	CHECK THAT THE USERNAME IS NOT TAKEN
	//====================================================================
 
		$SQL = "SELECT * FROM student WHERE sname = $sname";
		$result = mysql_query($SQL);
		$num_rows = mysql_num_rows($result);
 
		if ($num_rows > 0) {
			$errorMessage = "Username already taken";
		}
 
		else {
 
			$SQL = "INSERT INTO student (sname, init, fname, title, msname, gen, lang) VALUES ($sname, $init, $fname, $title, $msname, $gen, $lang)";
/////////////////////// addddddddddddd
		$result = mysql_query($SQL);
//			$result = mysql_query( $sql) or die(mysql_error());
 
 
			mysql_close($db_handle);
 
		//=================================================================================
		//	START THE SESSION AND PUT SOMETHING INTO THE SESSION VARIABLE CALLED login
		//	SEND USER TO A DIFFERENT PAGE AFTER SIGN UP
		//=================================================================================
 
			//session_start();
			//$_SESSION[';login';] = "1";
 
			header ("Location: page1.php");
 
		}
 
	}
	else {
		$errorMessage = "Database Not Found";
	}
 
 
 
 
	}
 
}
 
 
?>
 
	<html>
	<head>
	<title>Basic Login Script</title>
	<link rel="stylesheet" type="text/css" href="css.css">
 
 
	</head>
	<body>
 
 
<FORM NAME ="form1" METHOD ="POST" ACTION ="student_reg.php">
 
Surname: <INPUT TYPE = ';TEXT'; Name =';sname';  value="<?PHP print $sname;?>" maxlength="20"><br>
Initials: <INPUT TYPE = ';TEXT'; Name =';init';  value="<?PHP print $init;?>" maxlength="16"><br>
First Name: <INPUT TYPE = ';TEXT'; Name =';fname';  value="<?PHP print $fname;?>" maxlength="16"><br>
Title: 
<select name="title">
  <option value="<?PHP print $Mr;?>">Mr</option>
  <option value="<?PHP print $Mrs;?>">Mrs</option>
  <option value="<?PHP print $Miss;?>">Miss</option>
  <option value="<?PHP print $Ms;?>">Ms</option>
</select><br>
Maiden Surname: <INPUT TYPE = ';TEXT'; Name =';msname';  value="<?PHP print $msname;?>" maxlength="16"><br>
gender: <INPUT TYPE = ';TEXT'; Name =';gen';  value="<?PHP print $gen;?>" maxlength="16"><br>
language: <INPUT TYPE = ';TEXT'; Name =';lang';  value="<?PHP print $lang;?>" maxlength="16"><br>
 
 
 
 
 
 
 
 
<label>
  <input type="submit" name="button" id="button" value="Submit">
</label>
</FORM>
<P>
<?PHP print $errorMessage;?>
 
	</body>
	</html>