PHP Authentication Problem

Question

Well, it kinda doesnt work:

connect.php

<?php

$dbhost = "localhost";
$dbusername = "root";
$dbpassword = "root";
$db = "youtube_guy";

$connect = mysqli_connect($dbhost, $dbusername, $dbpassword, $db) or die("Could not connect to the database");

index.php

<?php

?>

<!DOCTYPE html>
<html>
<head>

</head>
<body>

    <form action="login.php" method="POST">
        <table>

            <tr>
                <td>Username</td>
                <td><input type="text" name="username" /></td>
            </tr>

            <tr>
                <td>Password</td>
                <td><input type="password" name="password" /></td>
            </tr>

            <tr>
                <td></td>
                <td><input type="submit" name="submit" value="Login" /></td>
            </tr>

        </table>
    </form>

</body>
</html>

login.php

<?php

SESSION_START();

// Check whether user has come from form
if(!isset($_POST['submit'])){

        echo "Please log in to continue";
        die("<br /><a href='index.php'>Log In </a>");
    }

    //Assigning variables
    $username = $_POST['username'];
    $passwordAttempt = $_POST['password'];
    $hashPasswordAttempt = md5($passwordAttempt);

    //Check forminputs
    if($username == "" || $username == NULL){

        echo "Please enter a username";
        die("<br /><a href='index.php'>Go back </a>");

    }

    if($passwordAttempt == "" || $passwordAttempt == NULL){

        echo "Please enter a passwordAttempt";
        die("<br /><a href='index.php'>Go back </a>");

    }

    include ('connect.php');

    $query ("SELECT * FROM users WHERE username ='$username'");
    $result = mysqli_query($connect, $query);
    $hits = mysqli_affected_rows($connect);

    if($hits < 1){

        echo "Incorrect username and password combination";
        die("<br /><a href='index.php'>Go back </a>");

    }


    while($row = mysqli_fetch_assoc($result)){

    $password = $row['password'];

    if($password != $hashPasswordAttempt){

        echo "Incorrect username and password combination";
        die("<br /><a href='index.php'>Go back </a>");

    }else(){

        // All check complete session starting
        $_SESSION['username'] = $username;

        header("location: loggedin.php");

        die("");

    }

}

loggedin.php

<?php

SESSION_START();

if(!isset($_SESSION['username'])){

    echo "Incorrect username and password combination";
    die("<br /><a href='index.php'>Go back </a>");

}

$username = $_SESSION['username'];

echo "Hello <strong> $username </strong> you have successfully logged in.";

It doesnt work when i click the submit button.

Answer 1 · 2015-07-14T23:18:05Z

July 14, 2015 11:18pm

hi Konrad, first of all you should check for some error messages.
Put this on top of your login.php page

<?php
ini_set('display_errors','On');
ini_set('error_reporting',E_ALL|E_STRICT);

SESSION_START();

also on line 57 you should get rid of parentheses () :

    while($row = mysqli_fetch_assoc($result)){

        $password = $row['password'];

        if($password != $hashPasswordAttempt){

            echo "Incorrect username and password combination";
            die("<br /><a href='index.php'>Go back </a>");

line 57 ->        }else(){

            // All check complete session starting
            $_SESSION['username'] = $username;

            header("location: loggedin.php");

            die("");

        }

after replicate your code the error message says:

Notice: Undefined variable: query in ./login.php on line 36

it might be a different message in your case.
But if not you just have to add [=] hier:

include ('connect.php');

line 36 ->    $query = ("SELECT * FROM php_auth WHERE username ='$username'");
                   $result = mysqli_query($connect, $query);
                   $hits = mysqli_affected_rows($connect);

hope this helps!

Answer 2 · 2015-07-15T13:30:51Z

July 15, 2015 1:30pm

Btw, what do you think to use this in a production site? of course, if i put security in it and look for better hashing system as well as some security from blog etc... ?

Security is the most important issue if you want to work in production mode
i think the best way to do it is to learn how some modern php frameworks like laravel etc.. did it.
it’s good to understand the way they handle security issues

and as well, talking about this code, is this the modern way to do it? with OOP?

think so?! but i believe there is no modern or old way to do it. as long it is secure and it works.

Also, i read somewhere, but im not sure, that phpMyadmin is not used as for production? really?

SSH tunnel might be more secure but i am not familiar with phpMyadmin

Well, SQL, SELECT * FROM etc.. this is a programming language right? it has nothing to do with phpMyadmin?

Sql is a special-purpose programming language designed for managing data held in a relational database management system(RDBMS) -{wiki}
phpMyAdmin is a free software tool written in PHP, intended to handle the administration of MySQL over the Web.

it can be addapted to any other server or host whatever ?

here is a nice article you should read https://www.digitalocean.com/community/tutorials/understanding-sql-and-nosql-databases-and-different-database-models

But i am sure that you will find better solutions and answers then mine so don't rely too much on my thoughs

keep up the good work ;)

Welcome to the Treehouse Community

Looking to learn something new?

Konrad Pilch

Konrad Pilch

PHP Authentication Problem

2 Answers

simhub

simhub

Konrad Pilch

Konrad Pilch

simhub

simhub

Konrad Pilch

Konrad Pilch