Coding not moving forward

InsidiousMennace · March 15, 2013

Hi Guys,

Well I started of with my login page using prepared statements, but at this point in time it does not do anything! Does not tell me weither the username and password is incorrect or right, does not move on to the next page, just nothing. Anything I am missing here?

login.php

JLT · March 15, 2013

 mysql_real_escape_string($username = $_POST["username"]);

This is a little funky to me, it should look like the following...

$username = mysql_real_escape_string($_POST["username"]);

Not only that, you don't need to use MRES, you are using query parameters kind of protects you against SQL Injection for you.

Chances are, your query could be failing, you don't really check if it fails. The while statement is relatively pointless too.

You are echoing data before your doctype declaration, this is invalid HTML however I believe it'll still output visible data to the browser.

On a side note, your password is stored in plain text which is a huge security issue. You should use a hashing algorithm such as hash. You also gave your database connection details, you shouldn't do that especially if it's publicly accessible.

I've given you a few things to sort out, perhaps this will give you a step in the right direction. Next time, you don't need to attach a file, you can insert code directly onto the forum. In the editor there is a little icon that looks a bit like using that will open a window for you to paste your code and the syntax etc

InsidiousMennace · March 15, 2013

Well I made som changes to my coding, seems I have a issue with my javascript function at the onclick event. Basically I am added <a href="javascript:login();">test</a></td> to test, that works as I am getting my message "submitting", and also there seems to be some issue with mysqli connection as I get my message " failed connection ".

<!DOCTYPE html>
<html>
    <script language = "javascript">
        function login()
        {
            alert("submitting");
            document.login.submit();
        }
    </script>
<form name="login" action="login.php?action=login" method="post">
    <table width="300" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC">
        <tr>
            <td>
            <table width="100%" border="0" cellpadding="3" cellspacing="1" bgcolor="#FFFFFF">
            <tr>
            <td colspan="3"><strong>Radius Login </strong></td>
        </tr>
        <tr>
            <td width="78">Username</td>
            <td width="6">:</td>
            <td width="294"><input name="username" type="text" id="username"></td>
        </tr>
        <tr>
            <td>Password</td>
            <td>:</td>
            <td><input name="password" type="password" id="password"></td>
        </tr>
        <tr>
            <td> </td>
            <td> </td>
           <td><input type="button" name="Submit" value="Login" onclick="javascript:login();"/><a href="javascript:login();">test</a></td>
        </tr>
    </table>
        </td>
        </tr>
    </table>
</form>
</html>

<?php
require_once 'config.php';

error_reporting(E_ALL);


//Connection to my database
$mysqli = new mysqli(DB_HOST,DB_USER,DB_PASSWORD);

if(mysqli_connect_errno())
            {
                printf("Connection failed: %s\n", mysqli_connect_errno());
                exit();
            }


if($_GET['action'] == 'login')
    {
            
            //prepared statement
            if($stmt = $mysqli->prepare("select * from login where username = ? and password = ?"))
            {
                
                $username = $_POST["username"];
                $password = $_POST["password"];
                
                //bind my parameters
                $stmt->bind_param("ss",$username,$password);
                
                //execute query
                $stmt->execute();
                
                //bind the result variables
                $stmt->bind_result($username,$password);
                
                //Store my values
                $stmt->store_result();
                
                //fetch values
                if($stmt->fetch())
                       {
                            $_SESSION["username"] = $username;
                            header("location : index.php");
                            exit();
                       }
                
                
                
                else
                {
                    echo "Username or password is incorrect";
                }
                
                $stmt->close();
                $stmt->free_result();
                
            }
            else
            {
                echo "Failed connection";
            }
    }
    else
    {
        echo("failed");
    }
        $mysqli->close();

?>

Sign In

Coding not moving forward

Recommended Posts

InsidiousMennace

Link to comment

Share on other sites

JLT

Link to comment

Share on other sites

InsidiousMennace

Link to comment

Share on other sites

Archived

Browse

Activity

Important Information