My register page looks like this:
<?php
include 'connect.php';
$username = mysqli_real_escape_string($conn, $_POST['username']);
$password = $_POST['password'];
$email = mysqli_real_escape_string($conn, $_POST['email']);
$usercheck = mysqli_query($conn,"SELECT username FROM users WHERE username = '".$username."'");
$emailcheck = mysqli_query($conn,"SELECT email FROM users WHERE email = '".$email."'");
$cost = 10;
$salt = strtr(base64_encode(mcrypt_create_iv(16, MCRYPT_DEV_URANDOM)), '+', '.');
$salt = sprintf("$2a$%02d$", $cost) . $salt;
$hash = crypt($password, $salt);
if (mysqli_num_rows($usercheck) > 0)
{
echo "username already exist";
}
elseif (mysqli_num_rows($emailcheck) > 0)
{
echo"email already exist";
}
else
{
$sql="INSERT INTO `database`.`users` (`username`, `password`, `email`) VALUES ('$username', '$hash', '$email')";
echo "account created";
if (!mysqli_query($conn, $sql))
{
die('error ' . mysqli_error($conn));
}
}
mysqli_close($conn);
?>
The register code work fine, I only have no idea how to login from that. I have this now My login code is:
<?php
include 'connect.php';
$username = $_POST['username'];
$password = $_POST['password'];
$sth = $conn->prepare('SELECT * FROM users WHERE username = :username LIMIT 1');
$sth->bindParam(':username', $username);
$sth->execute();
$user = $sth->fetch(PDO::FETCH_OBJ);
// Hashing the password with its hash as the salt returns the same hash
if ( crypt($password, $user->users) == $user->users ) {
echo "login?";
}
else
{
echo "error?";
}
?>
But it seems this is only for an validation, as result I get an blank page with nothing. Login form is in another script.
I need some advice because when I search the internet it gives something like this back also with crypt() login.
Sorry for the no comment in the code.
Thank you in advanced.
EDIT: changed the login code to this, but i don't know how to check the hash password:
<?php
include 'connect.php';
// Define $username and $password
$username=$_post['username'];
$password=$_post['password'];
//Check username and password from database
$sql="SELECT username FROM users WHERE username='$username' and password='$password'LIMIT 1";
$result=mysqli_query($db,$sql);
//If username and password exist in our database then create a session.
//Otherwise echo error.
if(mysqli_num_rows($result) == 1)
{
$_SESSION['username'] = $login_user; // Initializing Session
header("location: register.php"); // Redirecting To Other Page
}else
{
echo"testwrong";
}
?>
Ricardo