One more thing. Again dunno if this is important to you or not. But the form is susceptible to phishing attacks. I can submit post data to
http://travelderbyshire.com/register.php from anywhere I like.
All I need is the following code
<html>
<head>
</head>
<body>
<form action="http://travelderbyshire.com/register.php?type=small" method="post">
<input type="text" name="username" value=""> Username<br>
<input type="password" name="pass1" value=""> Password<br>
<input type="password" name="pass2" value=""> Confirm Password<br>
<input type="text" name="email" value=""> Email Address<br>
<input type="submit" name="submit" value="Register">
</form>
</body>
</html>
So someone could put up a site that registers someone for your site but stores the data they are submitting perhaps not so important for the user accounts but perhaps for the business account registration or login.
I submitted a registration from a html file on my desktop.
You could get round this by setting a session variable with a random value this value could also be written into a hidden from field. When the form submits, the value of the hidden form field is compared to the value of the session variable to check it is a legitimate submission from your site. There will be other ways to validate the submission comes from your form but it is well worth doing.
D
Not fussed at the mo as it's not a security thing
