Retrieving login details from my database and logging in

Question

Edit 1

I have found out that the problem is with the hash.

My Problem

I have made this set of code locally and I am now trying to port over to an actual domain. Database works perfectly fine. Registration works perfectly fine. However, when I log in the "Incorrect Credentials, Try again..." error pops up.

index.php

<?php
 ob_start();
 session_start();
 require_once 'dbconnect.php';

 // it will never let you open index(login) page if session is set
 if ( isset($_SESSION['user'])!="" ) {
  header("Location: home.php");
  exit;
 }

 $error = false;

 if( isset($_POST['btn-login']) ) { 

  // prevent sql injections/ clear user invalid inputs
  $email = trim($_POST['email']);
  $email = strip_tags($email);
  $email = htmlspecialchars($email);

  $pass = trim($_POST['pass']);
  $pass = strip_tags($pass);
  $pass = htmlspecialchars($pass);
  // prevent sql injections / clear user invalid inputs

  if(empty($email)){
   $error = true;
   $emailError = "Please enter your email address.";
  } else if ( !filter_var($email,FILTER_VALIDATE_EMAIL) ) {
   $error = true;
   $emailError = "Please enter valid email address.";
  }

  if(empty($pass)){
   $error = true;
   $passError = "Please enter your password.";
  }

  // if there's no error, continue to login
  if (!$error) {

   $password = hash('sha256', $pass); // password hashing using SHA256

   $res=mysql_query("SELECT id, username, password FROM users WHERE email='$email'");
   $row=mysql_fetch_array($res);
   $count = mysql_num_rows($res); // if uname/pass correct it returns must be 1 row

   if( $count == 1 && $row['password']==$password ) {
    $_SESSION['user'] = $row['id'];
    header("Location: home.php");
   } else {
    $errMSG = "Incorrect Credentials, Try again...";
   }

  }

 }
?>

register.php

 <?php
 ob_start();
 session_start();
 if( isset($_SESSION['user'])!="" ){
  header("Location: home.php");
 }
 include_once 'dbconnect.php';

 $error = false;

 if ( isset($_POST['btn-signup']) ) {

  // clean user inputs to prevent sql injections
  $name = trim($_POST['username']);
  $name = strip_tags($name);
  $name = htmlspecialchars($name);

  $email = trim($_POST['email']);
  $email = strip_tags($email);
  $email = htmlspecialchars($email);

  $pass = trim($_POST['password']);
  $pass = strip_tags($pass);
  $pass = htmlspecialchars($pass);

  // basic name validation
  if (empty($name)) {
   $error = true;
   $nameError = "Please enter your full name.";
  } else if (strlen($name) < 3) {
   $error = true;
   $nameError = "Name must have atleat 3 characters.";
  } else if (!preg_match("/^[a-zA-Z ]+$/",$name)) {
   $error = true;
   $nameError = "Name must contain alphabets and space.";
  }

  //basic email validation
  if ( !filter_var($email,FILTER_VALIDATE_EMAIL) ) {
   $error = true;
   $emailError = "Please enter valid email address.";
  } else {
   // check email exist or not
   $query = "SELECT email FROM users WHERE email='$email'";
   $result = mysql_query($query);
   $count = mysql_num_rows($result);
   if($count!=0){
    $error = true;
    $emailError = "Provided Email is already in use.";
   }
  }
  // password validation
  if (empty($pass)){
   $error = true;
   $passError = "Please enter password.";
  } else if(strlen($pass) < 6) {
   $error = true;
   $passError = "Password must have atleast 6 characters.";
  }

  // password encrypt using SHA256();  $password = hash('sha256', $pass);

  // if there's no error, continue to signup
  if( !$error ) {

   $query = "INSERT INTO users(username,email,password) VALUES('$name','$email','$password')";
   $res = mysql_query($query);

   if ($res) {
    $errTyp = "success";
    $errMSG = "Successfully registered, you may login now";
    unset($name);
    unset($email);
    unset($pass);
   } else {
    $errTyp = "danger";
    $errMSG = "Something went wrong, try again later..."; 
   } 

  }


 }
?>

This is the database table.

please use `error_reporting(E_ALL); ini_set('display_errors', 1);` on top of your pages and let us know any error thrown. What do your form look like ? are $vars well posted and can you check them before use ? — OldPadawan, Apr 11 '17 at 10:54
please consider using using native php `password_hash/password_verify` and, last but not least, as mysql_* was deprecated in PHP 5.5 (please refer to [PHP doc](http://php.net/manual/en/function.mysql-connect.php)) you should prefer [PPS : Prepared Parameterized Statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). This will help [Preventing SQL injection](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — OldPadawan, Apr 11 '17 at 10:56
I strongly advise you to [use PDO](http://php.net/manual/en/pdo.connections.php), and [prepared statements](http://php.net/manual/en/pdo.prepare.php), it's safer and more readable... — St3an, Apr 11 '17 at 11:31

Pankit Gami · Accepted Answer · 2017-04-11T11:13:17.133

1

In the photo there is no password for user.

You have commented the following line in register.php.

$password = hash('sha256', $pass);

Please uncomment this line like this.

// password encrypt using SHA256();  
$password = hash('sha256', $pass);

edited Apr 11 '17 at 11:13

answered Apr 11 '17 at 10:54

Pankit Gami

2,523
11
19

That has nothing to do with his question and can't solve this question... because the error is thrown in index.php – Casper Apr 11 '17 at 11:00
Because of that, password in the database is blank. Check the photo. – Pankit Gami Apr 11 '17 at 11:02
1

It's perfectly fine buddy. We miss sometimes. ;) :D – Pankit Gami Apr 11 '17 at 11:04
If I uncomment it the register page doesn't work all together. Thanks anyway. – Richard Speight Apr 11 '17 at 11:05
@RichardSpeight Please check the answer again. – Pankit Gami Apr 11 '17 at 11:12
@PankitGami Yes I have tried it your new way, still no progress. – Richard Speight Apr 11 '17 at 11:18
Did you create new user? – Pankit Gami Apr 11 '17 at 11:19
Yes, I am searching up a tutorial on proper hashing now. – Richard Speight Apr 11 '17 at 11:24
@RichardSpeight You can use `password_hash()` and `password_verify()` function of the `php`. – Pankit Gami Apr 11 '17 at 11:25
Does it give a error and could you show us the column types of the user table – Casper Apr 11 '17 at 11:31

Retrieving login details from my database and logging in

Edit 1

My Problem

index.php

register.php

1 Answers1