0

I'm an amateur at php mysqli queries. So i was working on a 2nd factor login where user inputs their security answer, but I wanted to echo the user's security question on the form, instead I'm ending up echoing the whole security questions of all users on my database. This is literally a cry for help. lol.

HTML CODE

<section id="client-auth-wrapper">
  <div class="container">
         <div class="card card-container">
             <img id="profile-img" class="profile-img-card" src="//ssl.gstatic.com/accounts/ui/avatar_2x.png" />
             <p id="profile-name" class="profile-name-card"></p>
             <form class="form-signin" method="post">
              <?php include ('second_security.php'); ?>
                 <span id="reauth-email" class="reauth-email"></span>
                 <p>Security Question:</p> <?php
                  $no = 1;
                  while ($row = mysqli_fetch_array($query)){
                  echo'
                  '.$row['security_quest'].'
                  ';
                  $no++;
                 }
                   ?>
                 <input type="text" id="inputAnswer" name="security_ans" class="form-control" placeholder="Security answer" required autofocus>
                 <button class="btn btn-lg btn-primary btn-block btn-signin" type="submit" name="submit">Submit</button>
             </form>
         </div>
     </div>
 </section>

PHP CODE

<?php
session_start();
$db = mysqli_connect('localhost', 'root', '', 'econ');
if (!$db) {
    die ('Failed to connect to MySQL: ' . mysqli_connect_error());  
}
$user_check = $_SESSION['username'];
$security_quest = $_SESSION['security_quest'];

$ses_sql = mysqli_query($db, "SELECT username FROM admin_users WHERE username = '$user_check'");
$row = mysqli_fetch_assoc($ses_sql);
 ?>
icy
  • 1,468
  • 3
  • 16
  • 36
chimex005
  • 11
  • 1
  • Security answers/questions are a terrible practice and are generally hated by users. They make your system weaker and provide no real advantage. – Dharman Jul 04 '19 at 19:35
  • yeah i actually know that. I have been on it for days, I used password_hash on my 1st login page and took measures there against SQL Injections. I made the code simple and very basic here with no real security measures against SQL injection for some reasons. I planned to take care of that eventually. But thanks for the info. – chimex005 Jul 04 '19 at 20:14
  • like i said initially, im still very much a self taught amateur, I usually start from basics and work my way up to security measures. Its not coming online, just gave myself some challenges to help improve. I'm more of a front-end web designer. So any info including security measures will be very helpful. Thanks – chimex005 Jul 04 '19 at 20:21
  • 1
    It is a very bad idea to use `die(mysqli_error($conn));` or `die(mysqli_connect_error());` in your code, because it could potentially leak sensitive information. See this post for more explanation: [mysqli or die, does it have to die?](https://stackoverflow.com/a/15320411/1839439) – Dharman Jul 04 '19 at 20:22
  • [The definitive guide to form-based website authentication](https://stackoverflow.com/a/477578/1839439) – Dharman Jul 04 '19 at 20:23

0 Answers0