Register / Login Issue

NZ_Kiwis

What is wrong, I have a very simple register / login page. But once I've registerd when I go to login it finds no rows. Why?
Register.php

$PW = $_POST['PW'];	
$PW = md5('$PW',$Salt);
$UN = $_POST['UN'];

$result = mysqli_query($link2, "INSERT INTO `members` (`Username`, `RegisterTime`, `Email`,`Password`,`Title`,`FirstName`, `LastName`) VALUES ('$UN', '$JS', '$EM','$PW','$TL','$FN','$LN')")or die ('Unable to execute query. '. mysqli_error($link2));;

$UN = trim($_POST['UN']);
$PW = trim($_POST['PW']);
$PW = md5('$PW',$Salt);
$result = mysqli_query($link2, "SELECT * FROM `members` WHERE Username = '$UN' and Password = '$PW'");	
$row_cnt = $result->num_rows;

Weedpacket

Apart from the mention of mysqli, this looks like code from the early 2000s. If it is, then has it ever worked, and what were you changing when you broke it?

The arguments to [man]md5[/man] aren't what you think they are (and read the warning on that page, too).
Also, see the page on SQL Injection.
Third, see the information on the different ways of writing strings. You're not storing or retrieving what you think you're storing or retrieving.

Have you verified that the submitted form data is correct in both cases?
Are you connected to the same database in both cases?

NZ_Kiwis

okay, blonde moment. It always worke.

What do you mean by " this looks like code from the early 2000s" ? what is wrong with the code?

Yes sql injection is taken care of but removed for this post when trying to solve my 'issue' that never existed.

NogDog

Instead of this:

$PW = md5('$PW',$Salt);

...try this:

$PW = md5($PW.$Salt);

You want to concatenate the salt, not use it as the 2nd (optional) parameter to md5(), and the $PW variable will not be interpolated within a single-quoted string.

laserlight

NZ_Kiwis wrote:
What do you mean by " this looks like code from the early 2000s" ? what is wrong with the code?

You wrote that "sql injection is taken care of but removed for this post", but if you were using prepared statements, then it wouldn't have made sense to go through the trouble of getting rid of them for this post, i.e., you were not using prepared statements as a way of separating incoming data from SQL statement in the interest of security, but rather were relying on a technique far more common in the early 2000s.
You used a single invocation of MD5 combined with a salt for hashing the password for storage. Granted, MD5 remains only theoretically broken for preimage attacks, but it has become obvious to ordinary software developers in the past decade that in practice, even when used with a user-specific salt to defeat rainbow tables, because of its speed MD5 is vulnerable to brute force attacks using modern hardware. So in the past couple of years using algorithms like PBKDF2, bcrypt, and scrypt that were designed for password hashing has become common knowledge, and probably since last year some may have switched over to Argon2, which won the recent competition to design a new secure password hashing algorithm. For PHP, [man]password_hash/man would be something to consider.