php login - something wrong with the validation in fields

Question

I have a problem with my login form, because if I put some text in password field and empty in the user/email field it the form will execute and redirect to index page.

this the site http://www.itbotics.com/login.php

other validations is ok, I just want to make it safe. thanks

this is my code

                    if ($user == $email && $pass = $password) {
                        session_start();
                        $_SESSION['mysesi'] = $name;
                        $_SESSION['user'] = $user;
                        echo "<script>window.location.assign('index.php')</script>";
                    } elseif (empty($email) || empty($password)) {
                        ?>
                        <div class="alert alert-danger alert-dismissible" role="alert">
                            <button type="button" class="close" data-dismiss="alert"><span aria-hidden="true">×</span><span class="sr-only">Close</span></button>
                            <strong>Warning!</strong> Please fill out all fields.
                        </div>
                        <?php
                    } else {
                        ?>
                        <div class="alert alert-danger alert-dismissible" role="alert">
                            <button type="button" class="close" data-dismiss="alert"><span aria-hidden="true">×</span><span class="sr-only">Close</span></button>
                            <strong>Warning!</strong> Incorrect combination of Email Address and Password.
                        </div>
        <?php
    }
}

I assume that you don't have required attributes in your form, so $user==$email can be equal && $pass=$password will always be equal because its an assignment — Priyesh Kumar
– Priyesh Kumar, Commented Jun 15, 2016 at 3:29
I sorry I will update the code because the $user and $pass is the data from the database — Mark Gerryl Mirandilla
– Mark Gerryl Mirandilla, Commented Jun 15, 2016 at 3:32
Another assumption. If you are using database , then there is no need to check if provided email and password are empty coz anyway database query will fail. And you might consider it doing before searching database or at client side — Priyesh Kumar
– Priyesh Kumar, Commented Jun 15, 2016 at 3:41

Darwin von Corax · Accepted Answer · 2016-06-15 04:19:41Z

2

I got it, maybe solution of your problem is here

if ($user == $email && $pass = $password) {

It should be:

if ($user == $email && $pass =**=** $password) {

edited Jun 15, 2016 at 4:19

Darwin von Corax

5,2643 gold badges20 silver badges33 bronze badges

answered Jun 15, 2016 at 3:31

sloaxleak

1065 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Devsi Odedra · Accepted Answer · 2016-06-15 03:31:45Z

1

Use &&(and) instead of ||(or)

Here

use this elseif (empty($email) && empty($password))

instead of elseif (empty($email) || empty($password))

Because in your condition if user enter any of the one either username or password then your condition become true.

So you have to use &&(AND) operator instead of ||(OR)

answered Jun 15, 2016 at 3:31

Devsi Odedra

5,3421 gold badge25 silver badges38 bronze badges

Comments

Priyesh Kumar · Accepted Answer · 2016-06-15 04:06:41Z

0

Change

 if ($user == $email && $pass = $password)

to

if ($user == $email && $pass == $password)

You already got your answer but here are few suggestions that may be good for you.

Do basic form validation all client side like

<input type="email" required >

Will do email validation for you

<input type="password" required minlength="6" >

Will take password of min length 6 character. You don't have to check it. Also "required" field makes sure that user can left those fields blank. HTML5 browser are required for those but I think most of the world have it.

In your php, do input validation before you execute database queries.

answered Jun 15, 2016 at 4:06

Priyesh Kumar

2,8571 gold badge17 silver badges29 bronze badges

2 Comments

Mark Gerryl Mirandilla Over a year ago

but using required can be edit by user through inspect element. also the password is auto generated by the system

Priyesh Kumar Over a year ago

I didn't mean that you should have only that. Its a layer of validation. Most of the basic users don't do this kind of inspect elements things. For those who do, you are also checking validation in php. So not a problem. Just try to use browsers feature to make your life easy

Collectives™ on Stack Overflow

php login - something wrong with the validation in fields

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related