Problem with bind_param()

[titan745]

Please forgive me as I am new to php. I'm going to try and explain my problem the best I can.

 

I'm trying to create a member login that checks that the username and password match before logging in.

 

membership.php:

require ('SQL.php');

class Membership {

function validate_User($un, $pwd) {
	$mysql = new MySQL();
	$ensure_credentials = $mysql->verify_Username_and_Pass($un, md5(trim($pwd) . PW_SALT));

	if($ensure_credentials) {
		$_SESSION['status'] = 'authorized';
		$_SESSION['uname'] = $un;
		header('location: index.php');

	} else return "Please enter a correct username and password";

}

 

SQL.php:

class Mysql {
private $conn;

function __construct() {
	$this->conn = new mysqli($DB_HOST, $DB_USER, $DB_PASSWORD, $DB_DATABASE) or 
				  die('There was a problem connecting to the database.');
}

function verify_Username_and_Pass($un, $pwd) {

	$query = "SELECT *
			FROM users
			WHERE username = ? AND password = ?
			LIMIT 1";

	if($stmt = $this->conn->prepare($query)) {
		$stmt->bind_param('ss', $un, $pwd);
		$stmt->execute();

		if($stmt->fetch()) {
			$stmt->close();
			return true;
		}
	}

}
}

 

After $un and $pwd are entered it returns "Please enter a correct username and password" regardless if the username and password are correct.

 

If I change this line

if($ensure_credentials) {

in Membership.php to

if($ensure_credentials != true) {

it will allow me to login, except it only verifies $un, and $pwd can be anything.

 

Please help!

[BlueSkyIS]

i see the function definition for validate_User, but where do you call it?

[titan745]

include ('../classes/Membership.php'); // Authentication class

$membership = new Membership();

// Did the user enter a password/username and click submit?
if($_POST && !empty($_POST['username']) && !empty($_POST['pwd'])) {
$response = $membership->validate_User($_POST['username'], $_POST['pwd']);
}

[BlueSkyIS]

in verify_Username_and_Pass, i would echo the SQL as it would be built, then take that query and run it in phpmyadmin to see if there is a match or not.

[nankoweap]

i wouldn't code it this way personally, but this should get you somewhere...

 

function verify_Username_and_Pass($un, $pwd) {
  $query = "SELECT count(*) FROM users WHERE username = ? AND password = ?";
  $stmt = $this->conn->prepare($query) or die($this->conn->error);
  $stmt->bind_param('ss', $un, $pwd);
  $stmt->execute();
  $stmt->bind_result($count);
  $success = $stmt->fetch();
  $stmt->close();

  return ($success && $count > 0);
}

[titan745]

There doesn't seem to be a problem with the query. It returns the correct values.

 

As far as this code:

function verify_Username_and_Pass($un, $pwd) {
  $query = "SELECT count(*) FROM users WHERE username = ? AND password = ?";
  $stmt = $this->conn->prepare($query) or die($this->conn->error);
  $stmt->bind_param('ss', $un, $pwd);
  $stmt->execute();
  $stmt->bind_result($count);
  $success = $stmt->fetch();
  $stmt->close();

  return ($success && $count > 0);
}

 

This doesn't seem to work. 

[nankoweap]

This doesn't seem to work. 

 

for someone who's seeking help, you're not providing much to go on. if it's failing, what are the errors?

[titan745]

When I replace the function  verify_Username_and_Pass with the below code and then run the script, all that I get is a blank page.

 

function verify_Username_and_Pass($un, $pwd) {
  $query = "SELECT count(*) FROM users WHERE username = ? AND password = ?";
  $stmt = $this->conn->prepare($query) or die($this->conn->error);
  $stmt->bind_param('ss', $un, $pwd);
  $stmt->execute();
  $stmt->bind_result($count);
  $success = $stmt->fetch();
  $stmt->close();

  return ($success && $count > 0);
}

 

With the function written the original way, it would return "Please enter a correct username and password". My guess, and this is a guess as I'm new to php, is that there seems to be a problem with telling the validate_User function that the validation has passed and to continue with the login.

 

Basically i think the problem is here somewhere:

function validate_User($un, $pwd) {
	$mysql = new MySQL();
	$ensure_credentials = $mysql->verify_Username_and_Pass($un, md5(trim($pwd) . PW_SALT));

	if($ensure_credentials) {
		$_SESSION['status'] = 'authorized';
		$_SESSION['uname'] = $un;
		header('location: index.php');

	} else return "Please enter a correct username and password";

}

 

Like I said though, I'm new to this and don't really know.  :-\ 

[nankoweap]

When I replace the function  verify_Username_and_Pass with the below code and then run the script, all that I get is a blank page.

 

a blank page, eh? i wonder if the redirect is working then. comment out this line:

 

header('location: index.php');

 

and replace it with:

 

print "user/pass validated";

 

what happens?

 

[titan745]

Still the same thing, just a blank page 

[nankoweap]

is error reporting turned on? put this line where your script first starts execution...

 

error_reporting(E_ALL);

[titan745]

error reporting is turned on but i don't see where there is an error.

[titan745]

I think I've been able to determine that the below code is not binding. (if that makes sense)

 

function verify_Username_and_Pass($un, $pwd) {

	$query = "SELECT *
			FROM users
			WHERE username = ? AND password = ?
			LIMIT 1";

	if($stmt = $this->conn->prepare($query)) {
		$stmt->bind_param('ss', $un, $pwd);
		$stmt->execute();

		if($stmt->fetch()) {
			$stmt->close();
			return true;
		}
	}

}

 

$un and $pwd are being passed to the function, but for whatever reason, $un and $pwd are not binding to the query.