sessions login script problem

[will35010]

I cannot get this script to work properly. It logs the user in and redirects them even if the credentials are invalid. How do I fix it please? Thanks!

 

<?php
session_start();

include('db.php');


if (isset($_POST['username'])) {
   
$username = $_POST['username'];
$password = $_POST['password'];    

//$username = mysqli_real_escape_string($_POST['username']);
//$password = mysqli_real_escape_string($_POST['password']);

// MySQL Query
$result = mysqli_query($conn, "SELECT * FROM staff WHERE username = '$username' AND password = '$password' ");

if(!$result) {
$_SESSION['error'] = '<span style="color: red">Login Failed</span>';
} else {
// Mysql fetch row results
$row = mysqli_fetch_assoc($result);

$_SESSION['userid'] = $row['id'];
$_SESSION['username'] = $username;
$_SESSION['error'] = 'Login successful<br> Welcome, '.$username;
header('Location: ./template.php');
}
}


?>

[PFMaBiSmAd]

$result will only be false if the query fails due to an error (sql syntax, database problem...) If the query executes without error, even if there are zero matching rows in the result set, $result will contain a result resource and pass the tests in your code.

 

You need to test the number of rows returned by the query.

[satya61229]

You need few things for redirect problem after users logout. I am in no mood of writing those long code written on blog. So search in the blog mentioned below. I am 100 % sure you will get the answer.

[JAY6390]

session_start();

include ('db.php');


if (isset($_POST['username'])) {

    $username = $_POST['username'];
    $password = $_POST['password'];

    //$username = mysqli_real_escape_string($_POST['username']);
    //$password = mysqli_real_escape_string($_POST['password']);

    // MySQL Query
    $result = mysqli_query($conn, "SELECT * FROM staff WHERE username = '$username' AND password = '$password' LIMIT 1 ");

    if (!$result || mysqli_num_rows($result) !== 1) {
        $_SESSION['error'] = '<span style="color: red">Login Failed</span>';
    } else {
        // Mysql fetch row results
        $row = mysqli_fetch_assoc($result);

        $_SESSION['userid'] = $row['id'];
        $_SESSION['username'] = $username;
        $_SESSION['error'] = 'Login successful<br> Welcome, ' . $username;
        header('Location: ./template.php');
        exit();
    }
}

Try that

[will35010]

Thank you! I fixed it with this:

 

<?php
session_start();

include('db.php');


if (isset($_POST['username'])) {
   
$username = $_POST['username'];
$password = $_POST['password'];    

//$username = mysqli_real_escape_string($_POST['username']);
//$password = mysqli_real_escape_string($_POST['password']);

// MySQL Query
$result = mysqli_query($conn, "SELECT * FROM staff WHERE username = '$username' AND password = '$password' ");

// Mysql_num_row is counting table row
$count=mysqli_num_rows($result);

if($count==1){
    // Mysql fetch row results
$row = mysqli_fetch_assoc($result);

$_SESSION['userid'] = $row['id'];
$_SESSION['username'] = $username;
$_SESSION['error'] = 'Login successful<br> Welcome, '.$username;
header('Location: ./template.php');
}
else {
    echo "Login Failed";
}
}
?>

 

$result will only be false if the query fails due to an error (sql syntax, database problem...) If the query executes without error, even if there are zero matching rows in the result set, $result will contain a result resource and pass the tests in your code.

 

You need to test the number of rows returned by the query.

[PFMaBiSmAd]

nevermind.