My PHP login system doesn't work

Question

My PHP login system doesn't work. My dbms is: phpMyAdmin. The connection is done in a different 'include' file. But I can't spot where and why my login system doesn't work.

html form:

<form id="form" action='index.php' method='post' enctype="multipart/form=data">
    Username: <input type='text' name='liusername'>
    Password: <input type='password' name='lipassword'>

    <input type='submit' value='Login'  name="lisubmit">
</form>

php code:

<?php

    isset ($_POST ['lisubmit']) {

        // Run the log in script here 
        $username = strip_tags($_POST['liusername']);
        $password = strip_tags($_POST['lipassword']);

        //find the record in database that corresponds to this user
        $query = "SELECT user_id, user_password FROM user WHERE user_username = '".$_POST['liusername']."'";

        //test to see if the password from the form is dame in database
        if ($row['user_password'] == $_POST ['lipassword'] && $row['user_username'] == $_POST ['liusername']) {
            $_SESSION ['loggedin'] = true;
            $_SESSION ['id'] = $row['user_id];
        } else {
            $_SESSION['loggedin'] = false;
            $_SESSION ['id'] = 0;
        }

        if ($_SESSION ['logginin') == true) {
            echo "<p>You are loggin in</p>\n";
        } else {
            echo "<p>You are NOT logged in</p>\n";
        }

?>

database connection file:

<?php

    session_start();
    $hostname = "localhost";
    $dbusername = "root";
    $dbpassword = "";   
    $dbase = "assignment";

    mysql_connect($hostname, $dbusername, $dbpassword) or die(mysql_error());

    mysql_select_db($dbase) or die(mysql_error());

?>

Answer 1

First:

Add the following at the top of you php script:

error_reporting(E_ALL);
ini_set('display_errors', '1');

The above will help you understand which lines of your code aren't correct (comment on production mode).

It should be if(isset($_POST['liusername'])) not only isset($_POST['liusername'])

The first part of you code should look like this:

error_reporting(E_ALL);
ini_set('display_errors', '1');

if(isset($_POST['liusername']))
{

---

Second:

If you strip_tags here:

$username = strip_tags($_POST['liusername']);

Why would you use the original $_POST['liusername'] on your query?
Also, you should use mysql_real_escape_string() instead of strip_tags to avoid mysql injections.

The second part of your code should look like this:

$username = mysql_real_escape_string($_POST['liusername']);
$password = mysql_real_escape_string($_POST['lipassword']);

---

Third:

You're not fetching anything from the DB.
To be able to get any results, like username and password, you first need to fetch the DB.

The third part your code should look like this:

$result = mysql_query("SELECT user_id, user_password FROM user WHERE 
    user_password = '$username' ");
$row = mysql_fetch_assoc($result); // You missed this

if ($row['user_password'] === $_POST['lipassword'] &&
$row['user_id'] === $_POST['liusername'] ){ // it's user_id not user_username

    $_SESSION ['loggedin'] = true;
    $_SESSION ['id'] = $row['user_id'];

}else{

    $_SESSION['loggedin'] = false;
    $_SESSION ['id'] = 0;
}

Conclusion:

Go over you code line by line and check for this type of errors.
I'll let you figure out the rest...

<?php

error_reporting(E_ALL);
ini_set('display_errors', '1');
session_start();
if(isset($_POST['liusername'])) {

    $username = mysql_real_escape_string($_POST['liusername']);
    $password = mysql_real_escape_string($_POST['lipassword']);

    $result = mysql_query("SELECT user_id, user_password FROM user WHERE 
        user_password = '$username' ");
    $row = mysql_fetch_assoc($result); // You missed this

    if ($row['user_password'] === $_POST['lipassword'] &&
     $row['user_id'] === $_POST['liusername'] ){ // it's user_id not user_username

        $_SESSION['loggedin'] = true;
        $_SESSION['id'] = $row['user_id'];

    }else{

        $_SESSION['loggedin'] = false;
        $_SESSION ['id'] = 0;
    }

}

You should spare some time to read this article:
http://www.wikihow.com/Create-a-Secure-Login-Script-in-PHP-and-MySQL

Answer 2

//below is the revised code 


<?php

session_start();

if(isset($_POST ['lisubmit'])) {

    // Clean the code coming from the user
    $username = strip_tags(trim($_POST['liusername']));
    $password = trim($_POST['lipassword']);

//find the record in database that corresponds to this user
    $result = mysql_query("SELECT user_id FROM user WHERE 
user_username = '" . $username . "' AND user_password='" . $password . "'");

//fetch the record
    $row = mysql_fetch_array($result);

//if record count is more than 0 than user's credentials are valid logged
//him in and set the session

    if (mysql_num_rows($result) > 0) {//valid user
        $_SESSION ['loggedin'] = true;
        $_SESSION ['id'] = $row['user_id'];
        echo "Login Successful";
    } else {

        $_SESSION['loggedin'] = false;
        $_SESSION ['id'] = 0;
        echo "Invalid Username password";
    }
}
?>

Answer 3

Try with below code i using without sessions login done:

Form.html:-

<form id="form" action='login.php' method='post' enctype="multipart/form=data">
        Username: <input type='text' name='myusername'></br>
        Password: <input type='password' name='mypassword'></br>
        <input type='submit' value='Login'  name="submit">
</form>

Login.php:-

<?php

$host="localhost"; // Host name 
$username="root"; // Mysql username 
$password=""; // Mysql password 
$db_name="Database name"; // Database name 
$tbl_name="Table name "; // Table name 

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

// username and password sent from form 
$myusername=$_POST['myusername']; 
$mypassword=$_POST['mypassword']; 

// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);
$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);
$count=mysql_num_rows($result);
if($count==1){
header("location:login_success.php");
}
else {
echo "Wrong Username or Password";
}
?>

login_success.php:-

<html>
<body>
Login Successful
</body>
</html>

this is working perfectly. Hope this helps.