0

Thanks for your time in advance.

I'm building an app with a login on it. On my proof of concept I used some old php, but then I realized I was vulnerable to SQL injection, so I switched to PDO.

I'm totally to PDO, so I don't fully understand how my code works ;). I'm getting an error telling me I have an "undefined password index on line 24". Can you show me what's wrong and what should I do?

Here's my code:

if ( isset ( $_POST ['loginButton'] ) ) {

    $errMsg = '';

    //username and password sent from Form
    $username = trim ( $_POST ['username'] ) ;
    $password = sha1 (  trim ( $_POST ['password'] ) ) ;

    if ( empty ( $username ) ) {
        $errMsg .= 'You must enter your Username<br>';
    }

    elseif ( empty ( $password ) ) {
        $errMsg .= 'You must enter your Password<br>';
    }


    elseif ( $errMsg == '' ) {

        $records = $databaseConnection->prepare ( 'SELECT * FROM  users WHERE email = :username' ) ;
        $records->bindParam ( ':username', $username ) ;
        $records->execute () ;

        $results = $records->fetch ( PDO::FETCH_ASSOC ) ;

        if ( count ( $results ) > 0 && password_verify ( $password, $results ['password'] ) ) {

            header ( 'location:dashboard.php' ) ;
            exit;

        }

        else {
                $errMsg .= 'Username and Password are not found<br>';
        }

    }

}
Ferrius
  • 69
  • 8

0 Answers0