Need help with password validation

[batman1]

I want to add password validation to this code so that it displays "Incorrect Password" if the email and password doesn't match...Need some help..

<?php 
    include('dbconnect.php');
    session_start();

    if(isset($_POST['userLogin'])){

        $email=mysqli_real_escape_string($conn,$_POST['email']);
        $pwd=md5($_POST['pwd']);
        $sql="SELECT * FROM user_info WHERE email='$email' AND password='$pwd'";
        $run_query=mysqli_query($conn,$sql);
        $count=mysqli_num_rows($run_query);

        if($count==1){
                $row=mysqli_fetch_array($run_query);
                $_SESSION['uid']=$row['user_id'];
                $_SESSION['uname']=$row['first_name'];
                echo "true";
        }
    }
    
 ?>

 

[maxxd]

http://us1.php.net/manual/en/function.password-verify.php

and

http://us1.php.net/manual/en/function.password-hash.php

[gizmola]

Whenever you accept user input, you should use prepared statements.

Make sure that your server is using the mysqlnd library.

At that point you no longer need escaping of input.

You are also using md5() without a salt, which is a terrible way of hashing passwords.  This is why the PHP project provides the password functions that maxxd linked for you.  You should convert your code to use those.

The simplest answer to your question, with prepared statement use thrown in would be this:

 

<?php 
    include('dbconnect.php');
    session_start();

    if(isset($_POST['userLogin'])){
        $pwd = md5($_POST['pwd']);
        $stmt = mysqli_stmt_init($conn);
        $stmt = mysqli_stmt_prepare($stmt, "SELECT * FROM user_info WHERE email=? AND password=?";
        // No escaping required!
        mysqli_stmt_bind_param($stmt, 'ss', $_POST['email'], $pwd);
        mysqli_stmt_execute($stmt);
        $result = mysqli_stmt_get_result($stmt);
        
        $rows = array();
        // Fetch all rows.  Should be 0 or 1, but if your db design is bad or query is flawed, you could have > 1
        while ($row = mysqli_fetch_array($result, MYSQLI_ASSOC)) {
            $rows[] = $row;
        }
        
        // Now count on rows    

        if (1 == count($rows)) {
            $row = $rows[0];
            $_SESSION['uid'] = $row['user_id'];
            $_SESSION['uname'] = $row['first_name'];
            echo "Login Successful";
            // Usually you would redirect to the Home page here using header();
            exit;
        } else {
            /* Usually you would redirect back to the login form 
               after putting the error message into either a hidden form field or a session variable */
            echo "Incorrect Password or Account";
            exit;
        }
    }
    
 ?>

 

[batman1]

Thank you for your replies!