User authentication PHP/SQL

Question

First of all. I'm new to both PHP/SQL and StackOverflow, so I'm sorry if my post is weird. I'm having a hard time figuring out what is wrong with my code. I have registered several users (each with a password ofc), but i only get login failed. Is it my if that is wrong?

Thank you.

<?php

session_start();

    //Connecting and choosing DB
    $connection = mysql_connect("link", "user", "pw");           
    mysql_select_db("user", $connection); 

    $username = mysql_real_escape_string($_POST['brukernavn']);
    $password = mysql_real_escape_string($_POST['passord']);


    // Check the users input against the DB.
    $sql = "SELECT * FROM brukere WHERE brukernavn = '$username' AND passord = '$password'";
    $result = mysql_query($sql) or die ("Unable to verify user because " . mysql_error());

    $row = mysql_fetch_assoc($result);

    if($row['total'] == 1)

    {
        $_SESSION['loggedIn'] = "true";
        header("Location: insertlink");
    }
    else
    {
        $_SESSION['loggedIn'] = "false";
        echo "<p>Login failed, username or password incorrect.</p>";
    }

?>

I know you said you're new to PHP/MySQL, so I recommend starting off right and NOT using the mysql_* functions. Look at mysqli or PDO (the latter being my personal preference). We would also need to see your registration code. Are you encrypting passwords when you save them? — muttley91
– muttley91, Commented Oct 2, 2014 at 23:04
1. mysql_* is deprecated, use mysqli_ or PDO. 2. You're storing clear-text passwords in your database, which is very bad. — lxg
– lxg, Commented Oct 2, 2014 at 23:04
@rar Thanks! I'll check them out. Is this my registration code then? $username = mysql_real_escape_string($_POST['nyttbrukernavn']); $password = mysql_real_escape_string($_POST['nyttpassord']); if(!isset($username) || trim($password) == '') { echo "Fyll ut de nødvendige feltene."; } else{ $sql="INSERT INTO brukere (brukernavn, passord) VALUES ('$username', '$password')"; — Jon Håvard Halvorsen
– Jon Håvard Halvorsen, Commented Oct 2, 2014 at 23:13
Yep, that's the insert statement. It looks like you're not encrypting the passwords (which you should be), so that doesn't answer why the login failed. Upon closer inspection, though, it looks like lxg pointed out the correct thing - there's no $row['total'], so it will automatically fail that conditional check. — muttley91
– muttley91, Commented Oct 3, 2014 at 2:44

lxg · Accepted Answer · 2014-10-02 23:12:22Z

3

There is no total field in the array returned by mysql_fetch_assoc().

If you want to know the number of results, use the count function:

if(count($rows) === 1)
…

Btw, as already mentioned:

mysql_* is deprecated, use mysqli_* or PDO.
You're storing clear-text passwords in your database, which is very bad. Please read about hashing and salting stored passwords.

answered Oct 2, 2014 at 23:12

lxg

13.2k13 gold badges56 silver badges81 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

gloomy.penguin Over a year ago

php documentation on password encryption

Jon Håvard Halvorsen Over a year ago

@lxg Thank you so much, sir! I'm going to check out mysqli_ and PDO.

lxg Over a year ago

nice link @gloomy.penguin. Didn't know that PHP has a dedicated article about this.

lxg Over a year ago

@JonHåvardHalvorsen: You're welcome. You will find mysqli to be more similar to the deprecated mysql (meaning that it may be easier to update mysql_* code to mysqli_*), while PDO is more "object oriented". In any case, you should use prepared statements instead of manually escaping data input. (which at least you do, others don't even care about that. ;))

Collectives™ on Stack Overflow

User authentication PHP/SQL

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related