[RESOLVED] Query results not matching input from login form

finisher1017

I'm working on creating a database application with a username/password login function. About a year ago I created a process form to check the username/password submitted through an HTML form against the corresponding info already existing in the MySQL database. The application seemed to work when I created it a year ago, but I've recently migrated the original code and database to a new development server and the process form doesn't seem to be matching the username/password entered from HTML with the username/password existing in the database, even though I know they are both correct. The connection to the database and the query seem to be working fine, but its the query results that seem to be the problem. Below is the code I'm using for the process form.

<?php

//connection to database "memberdirectory"
include ("dbconnect.inc");

$cxn= mysqli_connect($host, $user, $pass, $db);
if (!$cxn)
{
die('Unable to connect to database: ' . mysqli_error());
}

//password verification function
$userName=$POST['username'];
$userPass=$POST['password']; //password entered by user
$user_query="SELECT loginName FROM members WHERE loginName='$userName'";
$pass_query="SELECT password FROM members WHERE loginName='$userName'";
$user_result=mysqli_query($cxn,$user_query) or die ("Unable to execute query1" .mysqli_error());
$pass_result=mysqli_query($cxn,$pass_query) or die ("Unable to execute query2" .mysqli_error());
$user_row=mysqli_fetch_assoc($user_result);
$pass_row=mysqli_fetch_assoc($pass_result);

if (empty($userName)) {
echo "Invalid Username or Password1"; exit;}

if ($userPass == $pass_row['password'] && $userName == $user_row['username']) {header("Location: mainapp.php"); exit;}

else {

echo "'$pass_row', '$user_row'"; }

The last echo function was a generic error, but I change it so I could see specifically what results the from was pulling from the database, but the only result I get is:

'Array', 'Array'

What I'm not sure about is if this result is what the form is actually pulling from the db or am I missunderstanding what results the function is actually supposed to display. Any help would be appreciated.

Weedpacket

When posting in the forum, please use the forum markup tags described in the FAQs to mark up your forum posts to make them easier to read.

 'Array', 'Array'

That's what happens when you echo an array:

Arrays are always converted to the string "Array"; because of this, echo and print can not by themselves show the contents of an array. To view a single element, use a construction such as echo $arr['foo']. See below for tips on viewing the entire contents.

You're doing it here:

 echo "'$pass_row', '$user_row'";

finisher1017

I've changed the last echo statement to the following:

else {

echo $arr['$pass_row', '$user_row']; }

But now all I get is a blank page with no results. I'm guessing I'm still doing it wrong?

bradgrafelman

finisher1017;11029127 wrote:
But now all I get is a blank page with no results.

What you should also be getting is a 'Parse error' message in your PHP error logs since what you posted isn't valid syntax for accessing items in an [man]array[/man]. If you want to echo multiple scalar values in an array, then you have to access each of the values separately and concatenate them together (hopefully with some sort of separator in between them so that you can tell where one ends and the next begins).

Also, few other comments about your code:

```
$userName=$_POST['username'];
$userPass=$_POST['password']; //password entered by user
```
This will generate E_NOTICE level error messages if those external variables don't exist. (What's more: you'll still be executing the rest of the code even though it's nearly certainly guaranteed to fail.)
User-supplied data should never be placed directly into a SQL query, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. See [man]security.database.sql-injection[/man] for more info.

$user_query="SELECT loginName FROM members WHERE loginName='$userName'";
$pass_query="SELECT password FROM members WHERE loginName='$userName'";
$user_result=mysqli_query($cxn,$user_query) or die ("Unable to execute query1" .mysqli_error());
$pass_result=mysqli_query($cxn,$pass_query) or die ("Unable to execute query2" .mysqli_error());

Er... why are you executing two separate SQL queries against the same table using the same WHERE clause? If this table had 10 columns you needed data from, would you really execute 10 separate SQL queries?

Why not just execute one SQL query that SELECTs all of the columns you're interested in?

Speaking of the queries, there's really no need to even SELECT any of the columns at all. Instead, you could just SELECT some constant value (1 or TRUE is my favorite), add the password comparison to the WHERE clause, and simply check to see if any rows are in the result set or not - no need to fetch any data at all.

finisher1017

Makes sense and seems simpler. But just out of curiosity, by including the password comparison in the where clause, wouldn't I still be inserting user-supplied data into the query?

bradgrafelman

finisher1017;11029197 wrote:
Makes sense and seems simpler. But just out of curiosity, by including the password comparison in the where clause, wouldn't I still be inserting user-supplied data into the query?

Yes, which is why you should of course be sanitizing that value as well.