File manager - Edit - /home/webapp69.cm.in.th/u69319090038/Shop/api/auth/register.php
Back
<?php // POST /api/auth/register.php require_once __DIR__ . '/../init.php'; if ($_SERVER['REQUEST_METHOD'] !== 'POST') Response::error('Method not allowed.', 405); $ip = clientIp(); $body = getBody(); $username = trim($body['username'] ?? ''); $email = trim($body['email'] ?? ''); $phone = trim($body['phone'] ?? '') ?: null; $password = $body['password'] ?? ''; // ─── Validation ────────────────────────────────────────── if (!$username || !$email || !$password) { Response::error('Username, email, and password are required.'); } if (!filter_var($email, FILTER_VALIDATE_EMAIL)) { Response::error('Invalid email address format.'); } if (strlen($username) < 3 || strlen($username) > 50) { Response::error('Username must be between 3 and 50 characters.'); } if (!preg_match('/^(?=.*[0-9])(?=.*[!@#$%^&*()\-_=+\[\]{};:\'",.<>\/?\\\\|`~]).{8,}$/', $password)) { Response::error('Password must be at least 8 characters with a number and a symbol.'); } if ($phone && !preg_match('/^[0-9\+\-\s]{8,20}$/', $phone)) { Response::error('Invalid phone number format.'); } // ─── Rate limit ─────────────────────────────────────────── if (!RateLimit::check($ip, RL_REGISTER_MAX, RL_REGISTER_WINDOW)) { Response::error('Too many registrations from your IP. Please try again later.', 429); } $db = DB::conn(); // ─── Duplicate check ───────────────────────────────────── $stmt = $db->prepare('SELECT id FROM users WHERE email = ? OR username = ?'); $stmt->execute([$email, $username]); if ($stmt->fetch()) Response::error('Email or username already in use.', 409); if ($phone) { $stmt2 = $db->prepare('SELECT id FROM users WHERE phone = ?'); $stmt2->execute([$phone]); if ($stmt2->fetch()) Response::error('Phone number already in use.', 409); } // ─── Create user (Auto-Verified) ───────────────────────── $hash = password_hash($password, PASSWORD_BCRYPT, ['cost' => BCRYPT_COST]); $stmt = $db->prepare( "INSERT INTO users (username, email, phone, password_hash, role, is_email_verified, is_phone_verified) VALUES (?, ?, ?, ?, 'buyer', 1, 1)" ); $stmt->execute([$username, $email, $phone, $hash]); $userId = (int)$db->lastInsertId(); // ─── Fetch user for session token generation ───────────── $stmt = $db->prepare('SELECT id, username, email, phone, role, avatar_url FROM users WHERE id = ?'); $stmt->execute([$userId]); $user = $stmt->fetch(); // ─── Issue tokens directly (Bypassing OTP) ──────────────── $accessToken = buildAccessToken($user); $refreshToken = buildRefreshToken($user); saveSession($userId, $refreshToken, false); setRefreshCookie($refreshToken, false); Response::success('Account created and logged in successfully!', [ 'userId' => $userId, 'requiresOtp' => false, 'accessToken' => $accessToken, 'user' => [ 'id' => $userId, 'username' => $user['username'], 'email' => $user['email'], 'phone' => $user['phone'], 'role' => $user['role'], 'avatar_url' => $user['avatar_url'] ] ], 201);
| ver. 1.4 |
Github
|
.
| PHP 7.4.33 | Generation time: 0.25 |
proxy
|
phpinfo
|
Settings