/    Sign up×
Community /Pin to ProfileBookmark

php login script issue

Hi

I have made a registration form with email confirmation to activate the account and the registration form and email activation link all works ok but am having trouble with the login script which thought would be the easy part, the error I keep getting is after I click submit to login, it says false and can’t work out why, my coding for it is below

[code=php]
<div id=”column-left”>
<form action=”login.php” method=”post” >
<label for=”user_name”>Username:</label>
<input name=”user_name” type=”text” id=”user_name” size=”60″/>
<br><br>
<label for=”pass_word”>Password:</label>
<input name=”pass_word” type=”password” id=”pass_word” size=”30″/>
<br><br>
<input name=”submit” type=”submit” value=”Submit”/>
</form>
</div>

<div class=”clear”></div>

<?php

session_start(); // Starting Session
// Establishing Connection with Server by passing server_name, user_id and password as a parameter
$db = mysqli_connect(“” , “”, “”) or die(“Check connection parameters!”);
// Optionally skip select_db and use: mysqli_connect(host,user,pass,dbname)
mysqli_select_db($db,””) or die(mysqli_error($db));

if (mysqli_connect_error()) {
die (‘Failed to connect to MySQL’);
} else {
/*SUCCESS MSG*/
echo ”;
}

if(isset($_POST[‘submit’]))
{
$user_name = trim($_POST[‘user_name’]);
$pass_word = trim($_POST[‘pass_word’]);
$query = “SELECT user_name, pass_word FROM visitors WHERE user_name=’$user_name’ AND pass_word=’$pass_word’ AND com_code IS NULL”;
$result = mysqli_query($db,$query)or die(mysqli_error($db));
$num_row = mysqli_num_rows($result);
$row=mysqli_fetch_array($result);
if( $num_row ==1 )
{
$_SESSION[‘user_name’]=$row[‘user_name’];
header(“Location: profile.php”);
exit;
}
else
{
echo ‘false’;
}
}
?>
[/code]

Been trying for hours adjusting coding etc. but still keep getting false

to post a comment
PHP

2 Comments(s)

Copy linkTweet thisAlerts:
@NogDogJun 25.2015 — Looks like your query is not finding any matches. Without access to the database and understanding why com_code must be null, I can't really answer why. (Is there any possibility it's returning more than 1 row?)

However, I can say that your script is wide-open to SQL injection errors/attacks as currently implemented. At the very least, you need to escape the form input values being used in the query, or you could instead use a prepared statement with bound parameters to automatically take care of that for you.
Copy linkTweet thisAlerts:
@ianhaneyauthorJun 25.2015 — Hi NogDog

Thank you for the reply, appreciate it

I though putting in mysqli_real_escape_string would prevent it from sql injection as just done that

how can I check to see if it is returning more than 1 row?
×

Success!

Help @ianhaney spread the word by sharing this article on Twitter...

Tweet This
Sign in
Forgot password?
Sign in with TwitchSign in with GithubCreate Account
about: ({
version: 0.1.9 BETA 5.6,
whats_new: community page,
up_next: more Davinci•003 tasks,
coming_soon: events calendar,
social: @webDeveloperHQ
});

legal: ({
terms: of use,
privacy: policy
});
changelog: (
version: 0.1.9,
notes: added community page

version: 0.1.8,
notes: added Davinci•003

version: 0.1.7,
notes: upvote answers to bounties

version: 0.1.6,
notes: article editor refresh
)...
recent_tips: (
tipper: @Yussuf4331,
tipped: article
amount: 1000 SATS,

tipper: @darkwebsites540,
tipped: article
amount: 10 SATS,

tipper: @Samric24,
tipped: article
amount: 1000 SATS,
)...