1

I am a CS self-taught student and I am trying to make a login system for the admin. When I press the "login" button I am automatically redirected to login-check.php even if my password is wrong (no error message displayed). Do you know how can I fix it? The password has to be correct.

login-page.php

<html>
    <body>
        <form name ="login-form action="" method="post" action="logincheck.php">
            <input type="text" name="usernamme" placeholder="username" value="">
            <input type="password" name="password" placeholder="password" value="">
            <button type="submit" name="login" value="submit">Login</button>        
        </form>
    </body>
</html>

login-check.php

<?php

if(isset($_POST["submit"])){

    require("../config/db.php");

    $useruid = $_POST["username"];
    $password = $_POST["password"];


    $sql = "SELECT * FROM users WHERE boss_username=?";

    $stmt = mysqli_stmt_init($conn);

    if(!mysqli_stmt_prepare($stmt, $sql)){
        header("Location:login-page.php?error=sqlerror");
        exit();
    } else {
        mysqli_stmt_bind_param($stmt, "ss", $useruid);
        mysqli_stmt_execute($stmt);
        $result = mysqli_stmt_get_result($stmt);
        if($row = mysqli_fetch_assoc($result)){
            $pwdCheck = password_verify($password, $row["boss_password"]);

            if($pwdCheck == false){
                header("Location:login-page.php?error=wrongpassword");
                exit();
            } else if($pwdCheck==true){
                session_start();
                $_SESSION["userId"] = $row["$boss_username"]; 
                header("Location:login-page.php?login=success");
                exit();
            } else{
                header("Location:login-page.php?error=wrongpassword");
                exit();
            }

        } else {
            header("Location:login-page.php?error=nouser");
            exit();
        }
    }
}
?>
Kevin
  • 25,946
  • 2
  • 19
  • 21
Steve120
  • 25
  • 3
  • on a second look, is prob `$row["$boss_username"];` which is not set, and then in turn doesn't set your session var, but redirects. – Lawrence Cherone Oct 01 '19 at 15:19
  • eek, also can you see an issue with `mysqli_stmt_bind_param($stmt, "ss", $useruid);` – Lawrence Cherone Oct 01 '19 at 15:21
  • Possible duplicate of [mysqli\_fetch\_assoc() expects parameter / Call to a member function bind\_param() errors. How to get the actual mysql error and fix it?](https://stackoverflow.com/questions/22662488/mysqli-fetch-assoc-expects-parameter-call-to-a-member-function-bind-param) – Dharman Oct 01 '19 at 15:45

0 Answers0