PHP, my sql connection to database for login

Question

i need to confirm login using Php and mysql. My codes keep bringing 'username and password not correct even when it is. Please where did i get it wrong.

HTML code looks like this

PHP code looks like this

enter image description here

Thank you

Add your code here in a copyable form, and take out your credentials, please. — aynber, Sep 16 '16 at 16:30
you're doing the Password/User authentication entirely wrong. Read up on [password hashing](http://security.blogoverflow.com/2011/11/why-passwords-should-be-hashed/). — Martin, Sep 16 '16 at 16:32
also your code is vulnerable to Sql Injections. You can read here: http://php.net/manual/es/security.database.sql-injection.php — Pipe, Sep 16 '16 at 17:06

Senthil · Accepted Answer · 2016-09-16T16:41:26.293

issue 1 : $user_name = $_POST['username']; you have used single quotes wrongly . Same for password in the screen shot. https://i.stack.imgur.com/FlUyR.jpg

issue 2 : mysqli_query($CONNECTIONHANDLER, $QUERY) but you are missing connectionhandler.

Full Code changes :

$username = mysqli_real_escape_string($con,$_POST['username']);

$password = mysqli_real_escape_string($con,$_POST['pass_word']);


$rs = mysqli_query($con, "Select username, pass_word from verify where username = '%s' and pass_word = '%s'", $username, $upassword);

$check_user = mysqli_num_rows($rs);

if($check_user>0){
    echo "Logged in / valid user ";
} else {
    echo "username / password incorrect";
}

score 0 · Answer 2 · answered Sep 16 '16 at 16:30

0

change '$_POST[username]' to $_POST['username'] and same goes for password.

You are actually assigned string values instead of getting them from $_POST array

answered Sep 16 '16 at 16:30

Danyal Sandeelo

12,196
10
47
78

@masquellett did that work? – Danyal Sandeelo Sep 17 '16 at 20:30

score 0 · Answer 3 · answered Sep 16 '16 at 16:31

0

Remove simple quote

$username = $_POST['username'];
$password = $_POST['pass_word'];

Keep in mind that POST input should ALWAYS be sanitized to avoid injection

answered Sep 16 '16 at 16:31

rak007

973
12
26

score 0 · Answer 4 · answered Sep 16 '16 at 16:34

I think you are doing it wrong. Also you just posted your username and password on the internet. The query is redundant. You should just check for the presence of a user with such username and password (for example Select Count(*) from...) the second control you are doing is superfluous. Also you are declaring a variable inside a while and you are trying to access those values from outside of it.

Also there are some syntactic errors like quotes and stuff that other users already suggested.

PHP, my sql connection to database for login

4 Answers4