How to compare email and word passes of textboxes with the database

Navigation
0

I already have this code: 

   <?php
   ...
   $dbconn = mysqli_connect($servername, $username, $password, $dbname)or die("Failed to connect to database:" . mysqli_error($conn));

    $email = mysqli_real_escape_string($dbconn, $_POST['login']);
    $password = mysqli_real_escape_string($dbconn, $_POST['senha']);

    if (!empty($email) && !empty($password))
    {

    $query = "SELECT (email, password) FROM Paciente WHERE email = '$email' AND password = SHA('$password') ";
    $data = mysqli_query($dbconn, $query);
    $result = mysqli_num_rows($dbname);
    printf("Number of rows %d \n", $result);
    if ($result == 1) {

        $row = mysqli_fetch_array($data);
        $email = $row('login');
        $password = $row('senha');
        header("location: marcar_consulta_online.html");
    } else {

        echo "A password e/ou email estão erradas";
    }

    }
    else
    {

        echo ' Deve preencher com o seu email e password';
        ?>

    <?php
    }
    mysqli_close($dbcon);
    ?>

   no outro código tenho: 

   <form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post">
    <p style="font-size: 20px"> <font face= "Verdana">
        Email:<INPUT type="text" name="login" size=35><br><br>
        Password:<INPUT type="password" name="senha" size=30>
    </p></font>

    <input type="submit" value="Login" name="botao_login" class="botao_login"/></FORM>

When I click the button it writes the message: 'You must fill in your email and password', which should only happen if the fields are empty.

    
asked by anonymous 09.06.2017 / 18:23

2 answers

0

Just missing

$POST['senha']

in $password = mysqli_real_escape_string($dbconn, $POST['senha']);

for

$_POST['senha']

Correct 

$email = mysqli_real_escape_string($dbconn, $_POST['login']);
$password = mysqli_real_escape_string($dbconn, $_POST['senha']);
    
09.06.2017 / 19:05
0

You are mixing mysqli_ and mysql_ functions, do not do this!

It is also not recommended to create the SQLs like this, even though you use mysqli_real_escape_string. It is recommended to use prepared statements , which in fact does this for you automatically.

Another thing, do not save the passwords in text format in the database. If an attacker gets access to the database, it will have all the passwords and emails easily. Learn more by searching on google for "php generating password hash" since I can not for more than 2 links still in the answer.

On the error, if you search the method documentation, you will see a comment :

  mysqli_real_escape_string () will return an empty string!

If you look closely at the code 

$dbconn = mysqli_connect($servername, $username, $password, $dbname);
...
$email = mysqli_real_escape_string($dbconn, $_POST['login']);
$password = mysqli_real_escape_string($dbconn, $POST['senha']);

/ p>

You will see that you used $ POST, without the "_", in the password line

    
09.06.2017 / 18:34
get content random url within txt file String Handling - javaFX Application