Verifying email and password input from a mysql database via php

Question

I have been trying my best at the review and pursue section for chapter 15 of Larry Ullman's PHP and MySQL book 4th edition, login_ajax.php, where it said:

Modify login_ajax.php so that it uses a database to confirm successful login.

This is what I've tried so far, whatever I do, the response I get seems to always be "INCORRECT" and then the ajax script never logs me in.

My code so far:

<?php

if (isset($_GET['email'], $_GET['password'])){

$email = $_GET['email'];
$password = $_GET['password'];

// Need a valid email address:
if (filter_var($email, FILTER_VALIDATE_EMAIL)) {

    // must match specific values:
    // This values will be gotten from a database

    require('../mysqli_connect.php');

    // retrieve from database

    $q = "SELECT email, pass FROM users WHERE email = '$email'LIMIT 1";

    // run the query
    $r = @mysqli_query($dbc, $q);


    //$check_email = "";
    //$check_pass = "";

    /*while ($row = mysqli_fetch_array($r, MYSQLI_ASSOC)) {

        $check_email = $row['email'];
        $check_pass = $row['pass'];

    }*/   // if the email and password match those in database

    //if (($email == $check_email && $password == $check_pass)) {
    if (mysqli_num_rows($r) > 0) {

        echo 'CORRECT';


    } else {

        echo 'INCORRECT';
    }



    mysqli_close($dbc);


    /*    if(($_GET['email'] == '[email protected]') && ($_GET['password'] == 'testpass')){

            //Set a cookie, if you want, or start a session.
            // indicate  success:
            echo 'CORRECT';

        }else{// mismatch

            echo'INCORRECT';
        }*/
}else{ // invalid email

    echo 'INVALID_EMAIL';
}

}else{ // missing one of the two variables

echo 'INCOMPLETE';

}

It contains my different tries.

Need space before limit '$email' LIMIT 1"; Better use prepare statement. Remove @ before mysqli_query — Saty
– Saty, Commented Aug 3, 2017 at 13:01
remove @ sign from @mysqli_query so that you can see when your query has errors — Semi-Friends
– Semi-Friends, Commented Aug 3, 2017 at 13:02
An aside, use the password API and stop using plain test passwords. — Jonnix
– Jonnix, Commented Aug 3, 2017 at 13:04
try using checking isset method for both in diff case. if(isset($_POST['email']) && isset($_POST['password'])) Not sure though. — Parth Goswami
– Parth Goswami, Commented Aug 3, 2017 at 13:11

Marvin-wtt · Accepted Answer · 2017-08-03 13:25:59Z

3

First of all, I would never use GET to commit a password for security reason. To check, if a password is correct, I would suggest to use the php function password_hash() and password_verify() to store the passwords not in plain text.

But to answer your origin question: To see the errors of your query, simply remove the "@" sign in front of your query. I would also add a space before the "LIMIT" statement.

If it still doesn't work correctly, try to get the mysqli error and post it.

Good luck :)

answered Aug 3, 2017 at 13:25

Marvin-wtt

5112 gold badges6 silver badges19 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

gudchyld Over a year ago

just hearing about those functions for the firsty, password_hash()and password_verify(), will sure look up on them, thanks for your suggestions @MarvinX

gudchyld Over a year ago

thanks a million, it finally worked with your suggestions, i'm quite new to all these but gonna give password security and try @MarvinX

Bhargav Chudasama · Accepted Answer · 2017-08-03 13:10:54Z

1

you only check email but you also check your password field

if email is correct so user will login with wrong password

try this query

$q = "SELECT email, pass FROM users WHERE email = '$email' and password = '$password' LIMIT 1";

and space between $email and LIMIT

or

remove @ from mysqli_query so its give error for better understaning

edited Aug 3, 2017 at 13:10

answered Aug 3, 2017 at 13:05

Bhargav Chudasama

7,2256 gold badges24 silver badges41 bronze badges

1 Comment

gudchyld Over a year ago

thanks for the headsup about the password check, gonna add that, the script finally worked with the suggestions to limit and @

Lars Peterson · Accepted Answer · 2017-08-03 13:05:47Z

0

You didn't show the HTML, but I will try to answer with what you gave me.

Add a space between '$email' and LIMIT
Make sure you have data in the database.
Double check the HTML where you set the name attribute in the form and be sure it matches the $_GET[] name.

answered Aug 3, 2017 at 13:05

Lars Peterson

1,5321 gold badge12 silver badges27 bronze badges

Collectives™ on Stack Overflow

Verifying email and password input from a mysql database via php

3 Answers 3

2 Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related