php login, i can login even i enter uppercased password or vice versa

Question

i have this code in my login, then i tried to input my password for example my real password is "Reymar25", but when i enter "reymar25" it logins, it should not proceed in the other page. , please help me to resove this.. THANK You

<?php

include('dbconnection.php');

if (isset($_POST['submit']))
{
    $username = $_POST['username'];$password = $_POST['password'];

    $query = mysql_query("SELECT * FROM tbl_user username = '".$username."' AND password = '".$password."' LIMIT 1");

    //("SELECT * FROM tbl_user WHERE username = '".$username."' AND password =       '".$password."' LIMIT 1"); 

    if (mysql_num_rows($query) == 1)
    {
        $row = mysql_fetch_array($query);
        header("Location: index1.php"); // Modify to go to the page you would like 
        exit; 
    }
    else
    { 
        header("Location: loginform.php"); 
        echo "Please Check Username or Password!";
        exit();
    }
}
?>

[Please, don't use `mysql_*` functions in new code](http://bit.ly/phpmsql). They are no longer maintained [and are officially deprecated](https://wiki.php.net/rfc/mysql_deprecation). See the [red box](http://j.mp/Te9zIL)? Learn about [*prepared statements*](http://j.mp/T9hLWi) instead, and use [PDO](http://php.net/pdo) or [MySQLi](http://php.net/mysqli) - [this article](http://j.mp/QEx8IB) will help you decide which. If you choose PDO, [here is a good tutorial](http://j.mp/PoWehJ). **You are also wide open to [SQL injections](http://stackoverflow.com/q/60174)** — John Conde, Apr 14 '14 at 21:00
Aside from the gaping security hole, are you using a case-insensitive character set (ending in _ci) in that table? — xd6_, Apr 14 '14 at 21:02
Sir i dont use any encryption function, i just want to compare the value of input password and the password from the database, because uppercase and lowercase characters is my problem, — reymar, Apr 15 '14 at 07:00

score 2 · Answer 1 · answered Apr 14 '14 at 21:05

Check the collation settings of your username and password columns. See http://dev.mysql.com/doc/refman/5.0/en/case-sensitivity.html

(And please read the comments on your question, they contain important information on how to address other issues with your code)

score 0 · Answer 2 · edited May 23 '17 at 10:25

0

About the question:

Why do you repeat the SQL statement two times? The query is however correct. I think you probably need to make columns case sensitive. See this answer.

The mechanism you implement however, is a very weak:

One can use SQL injection.
You store passwords in plain text, if one hacks your server, he/she can hack all the passwords out of it, you should use hashes. You can for instance use the username as the salt to generate a hash and then check if the hash exists somewhere in your database.
You only delegate your page when the user enters the correct password. In order to make a website safe, you should check the password each time in the header of each page that should be protected.

edited May 23 '17 at 10:25

Community

1
1

answered Apr 14 '14 at 21:04

Willem Van Onsem

443,496
30
428
555

Sir i am not familiar with encryption in PHP, may you teach me on what proper encryption and decryption process should i use? – reymar Apr 15 '14 at 07:56
You should not encrypt/decrypt. But calculate a hash. That is a function that takes as input username and password and returns a long binary code. The code is not reversible. Thus even if they capture hashes, they can perhaps login, but don't know the password. I think this page offers a good introduction: http://php.net/manual/en/faq.passwords.php – Willem Van Onsem Apr 15 '14 at 08:20

score 0 · Answer 3 · answered Apr 15 '14 at 15:06

i tried this code and it works. sorry if i am not using PDO,

if (isset($_POST['submit']))
{
$username = $_POST['username'];
$password = $_POST['password'];


$query = mysql_query("SELECT * FROM tbl_user LIMIT 1");

while($row = mysql_fetch_array($query))
{
if(strcmp($username,$row['username'])==0 && strcmp($password,$row['password'])==0)
{

header("Location: index1.php");

}
else
{
echo "Somethings wrong either on your Username or Password Please Try Again" ;
}
}

} ?>

php login, i can login even i enter uppercased password or vice versa

3 Answers3