PHP Login Script Not Working Properly

Question

I am trying to make a login form with php and mysql and failed from past 3 days.

I have basically php form and on the same page the scripting for logging the user into the website.

form.php

<form id="superAdminForm" method="post" action="">
   <input type="email" name="email" required class="txtInput" placeholder="Email..." autocomplete="off"/> <br />
   <input type="password" name="password" required class="txtInput" placeholder="Password..."/> <br />
   <input type="submit" name="submit" value="Enter" id="submit" />
</form>

php code for form.php

<?php
    require("../php_includes/db-connect.php");

    if (isset($_POST["submit"])) {
        $email = $_POST["email"];
        $password = $_POST["password"];

        $sql = "SELECT * FROM users WHERE email='$email' AND password='$password' LIMIT 1";
        $query = mysqli_query($con, $sql);

        $row = mysqli_fetch_array($query);

        if ($row['email'] == 1) {
            header("Location: admin-index.php");
        }
    }

    mysqli_close($con);

?>

The problem is that the login is not getting successfull. I don't know the reason behind it. So please help me in this. Also guide me where I am making mistakes.

I am new in PHP and am trying my best to cope up with my knowledge.

Agreed. I refrained from saying so in my answer, but I'd suggest looking into PDO for PHP (there are countless debates on the best way to handle PHP/database interaction, but that is my personal favorite) — Jordan Foreman
– Jordan Foreman, Commented Sep 17, 2013 at 15:50
You will also need to use php's sessions for this to work properly — brenjt
– brenjt, Commented Sep 17, 2013 at 15:50

Community · Accepted Answer · 2017-05-23 12:30:34Z

1

1.. Talking about security

your code is vulnerable to sql injection so even if it will work its not useful

^^ source

' or '1'='1' /* ' will do magic

so either use mysqli_real_escape_string function For manually escaping special characters in string or Use prepared statements and parameterized queries(Recommended).

2.. email='$email' AND password='$password' LIMIT 1";

so why not email should be unique or check when login that email is already exist or not and if exist than show the error message like (Email already exist)

so you wont need to use limit 1 which really makes no sense

3.. Why are you not setting login id or something in SESSION so that you can determine that use is logged in

your above login script does nothing it just check weather the email and password is present in database or not

4.. plan text as password is really bad idea instead use Hashing check this How do you use bcrypt for hashing passwords in PHP?

Good Read

How can I prevent SQL injection in PHP?

edited May 23, 2017 at 12:30

CommunityBot

11 silver badge

answered Sep 17, 2013 at 15:51

Mayank K. Swami

57.3k23 gold badges130 silver badges148 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Mayank K. Swami Over a year ago

@Mehul Bawadia check those videos Password Storage (And Hacking) in PHP and Password Hashing in PHP

Mayank K. Swami Over a year ago

@Freelancer there is always xkcd for everything ;)

Jordan Foreman · Accepted Answer · 2013-09-17 16:28:58Z

1

I think that what you need to do is to separate your view logic from your authentication logic. Move the PHP block into its own file, and set the action parameter of your form to that file (relative location).

This is because all of that php code is interpreted by the server before being sent to the client, and so this form can't actually utilize that PHP logic in the same page.

You'll also probably want to write a fallback in case authentication fails that will redirect you back to the login page (or wherever you'd like), otherwise the user will be left with a white screen.

EDIT

As stated by others, you should look into security and especially hooking into $_SESSIONs. Your code is also going to need some work. I don't think $row['email'] == 1 will ever be true, and so your script will fail and ultimately do nothing. Again, add an else statement to handle authentication failure.

As far as a fix, I'd suggest comparing $row['email'] == $email in the if, but that would also make the email check in your SQL query redundant. I'd suggest restructuring your logic.

edited Sep 17, 2013 at 16:28

answered Sep 17, 2013 at 15:48

Jordan Foreman

3,8887 gold badges45 silver badges67 bronze badges

2 Comments

Mehul Bawadia Over a year ago

I did as you said, but am getting a blank screen, what to do now ?

Jordan Foreman Over a year ago

Updated answer for ya

Mihai · Accepted Answer · 2013-09-17 15:54:09Z

0

rows=mysqli_num_rows( $query);
if ($rows == 1) {
     header("Location: admin-index.php");
}

You are comparing an array to an int,use the code above.

edited Sep 17, 2013 at 15:54

answered Sep 17, 2013 at 15:53

Mihai

26.8k8 gold badges71 silver badges87 bronze badges

Collectives™ on Stack Overflow

PHP Login Script Not Working Properly

3 Answers 3

2 Comments

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related