I have been trying to figure out this problem for days now. For some reason, whenever I try to use this, The password goes thru as wrong. Im thinking that this might be a database issue, but I have displayed the hash password from the database. I hope I can resolve this.(I know I can simplify some of this, but I like to have everything laid out so I can visualize it.)
login.php
session_start();
$output = NULL;
function sanitize($conn, $val){
$val = stripslashes($val);
$val = mysqli_real_escape_string($conn, $val);
}
//Checks if user is already logged in
if(!isset($_SESSION['loggedin'])){
?>
<form method="POST">
Email: <input type=TEXT name="email"><br>
Password: <input type=PASSWORD name="password"><br>
<input type="SUBMIT" name="submit" value="Log In"><br>
</form>
<?php
}else{
echo "You are already loged in!";
}
//Check Form
if(isset($_POST['submit'])){
//Connect to DB
include "core/database/dbConnect.php";
//Takes information out of feilds
$email = $_POST['email'];
$password = $_POST['password'];
//sanitize input
sanitize($conn, $email);
sanitize($conn, $password);
//Check if form is filled out
if(empty($email) || empty($password)){
$output = "Please enter all fields!";
}else{
$query = "SELECT * FROM users WHERE email ='$email'";
$result = mysqli_query($conn, $query);
$count = mysqli_num_rows($result);
$row = mysqli_fetch_array($result, MYSQLI_ASSOC);
$hash = $row['password'];
$passwordsMatch = password_verify($password, $hash);
if($count == 0 or $passwordsMatch == false){
$output = "Invalid email/password";
}else{
//User logged in sucessfully, inserting session data
$_SESSION['loggedin'] = TRUE;
$_SESSION['email'] = $email;
$_SESSION['id'] = $row['id'];
$_SESSION['username'] = $row['username'];
header('Location: index.php');
exit();
}
}
}
echo $output;
?>
register.php
<div class="pageContent">
<form method="POST">
Username:
<input type="TEXT" name="username"><br>
Password:
<input type="PASSWORD" name="password"><br>
Repeat Password:
<input type="PASSWORD" name="rpassword"><br>
Email Address:
<input type="TEXT" name="email"><br>
<input type="SUBMIT" name="submit" value="Register"><br>
</form>
<?php
session_start();
//Takes information out of feilds
$username = $_POST['username'];
$password = $_POST['password'];
$rpassword = $_POST['rpassword'];
$email = $_POST['email'];
$output = NULL;
function sanitize($conn, $val){
$val = stripslashes($val);
$val = mysqli_real_escape_string($conn, $val);
}
//Runs all code if Register is clicked
if(isset($_POST['submit'])){
//Connect to DB
include "core/database/dbConnect.php";
//Sanitizes input
sanitize($conn, $username);
sanitize($conn, $password);
sanitize($conn, $rpassword);
sanitize($conn, $email);
//Query's the username for duplicates
$usernameQuery = $conn->query("SELECT * FROM users WHERE username = '$username'");
//Query's the email for duplicates
$emailQuery = $conn->query("SELECT * FROM users WHERE email = '$email'");
//Checks if all feilds are filled
if(empty($username) OR empty($password) OR empty($rpassword) OR empty($email)){
$output = "Please fill in all fields!";
//Checks if username is already taken
}elseif($usernameQuery->num_rows != 0){
$output = "That username is already taken!";
//Checks if password and rpassword matches
}elseif($rpassword != $password){
$output = "Your passwords don't match!";
//Checks if username has more than 5 characters
}elseif(strlen($username) < 4){
$output = "Your username must be at least 4 characters!";
//Checks if password has more than 5 characters
}elseif(strlen($password) < 7){
$output = "Your password must be at least 7 characters!";
//Checks if email is already in use
}elseif($emailQuery->num_rows != 0){
$output = "The email is already in use! Do you already have an account?";
//Checks if email is a valid email
}elseif(filter_var($email, FILTER_VALIDATE_EMAIL) == FALSE){
$output = "The email you have entered is not valid!";
}else{
//Hashing password
$password = password_hash('$password', PASSWORD_BCRYPT, array(
'cost' => 10
));
//Insert data in DB users
$insert = $conn->query("INSERT INTO users(username,password,email) VALUES('$username','$password','$email')");
if($insert == TRUE){
$output = "You account was created! Please login!";
}else{
$output = $error;
}
}
}
echo $output;
?>
dbConnect.php
<?php
$error = "Sorry, Somthing went wrong!";
$conn = NEW MySQLi('localhost', 'root', '', 'phplogin') or die($error);
?>
DB Setup enter image description here
