PHP Username/Password Authentication.

Question

I'm trying to create a simple username and password form with PHP and MySQL. When I create a username and password, it shows up in the database. When I try to login with that same username/password I get an error. I'm not sure why? Below is my code for the loginVerify.php file

<?php
session_start();

unset($_SESSION['badPass']);

//username and passowrd sent from form
$myusername = $_POST['myusername'];
$mypassword = $_POST['mypassword'];

//Connect to server and select datbase
require_once '../DatabaseConnection/dbconnect.php';

//protect MySQL injection
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = $con->real_escape_string($myusername);
$mypassword = $con->real_escape_string($mypassword);

//hashing
$hashedPassword = hash("ripemd128", $mypassword);

$sql = "SELECT * FROM `users` WHERE `username`='$myusername' AND `password`='$hashedPassword'";

$result = $con->query($sql);

if (!$result) {
    $message = "whole query " . $sql;
    echo $message;
    die('Invalid query: ' . mysqli_errno($con));
}

//if result matched $mysername and $mypassword, table row must be 1 row
if (mysqli_num_rows($result) == 1) {
    $_SESSION['user'] = $myusername;
    $_SESSION['password'] = $hashedPassword;

    //Register $myusername, $mypassword and redirect to file "welcome.php"
    header("Location:welcome.php");   
} else {
    header("Location:login.php");
    $_SESSION['badPass']++;
    echo "Wrong Username or Password";
}
?>

This is the PHP code I have on the login.php file.

 <td>Password</td>
                        <td>:</td>
                        <td><input name="mypassword" type="password" id="mypassword">
                           <?php
                            if (isset($_SESSION['badPass'])) {
                                echo "Wrong User Name or Password";
                                unset($_SESSION['badPass']);
                            }
                             ?>
                        </td>

Answer 1 · 2018-09-03T20:49:03Z

September 3, 2018 8:49pm

To get a definitive answer, you'll have to post the code you are using to add the username and password to the database. The password will have to hashed in the same way you are doing with $hashedPassword = hash("ripemd128", $mypassword); before inserting to the database.

password_hash and password_verify are now the better and more secure options for handling passwords but this is fine for learning purposes.

Welcome to the Treehouse Community

Looking to learn something new?

Daniel Silva

Daniel Silva

PHP Username/Password Authentication.

1 Answer

Sheldon Reiff

Sheldon Reiff