Login with PHP + MYSQL + MD5

Navigation
2

I created a login form with the following code:

Login.html: 

<form action="login.php" method="post">
<input type="hidden" name="id" value=''>
Usuário<input type="text" name="usuario" id="usuario" >
Senha<input type="password" name="senha" id="senha">
<input type="submit" name="entrar" id="entrar" value="Entrar">
</form>

The php code:

Login.php: 

<?php
//inclui arquivo com conexao ao banco
include_once('db.php');

$usuario = mysql_real_escape_string($_POST['usuario']);
$senha = md5(mysql_real_escape_string(($_POST['senha'])));
$entrar = $_POST['entrar'];
    if ($_POST['entrar']) {

        $sql = "SELECT * FROM login WHERE usuario='$usuario' AND senha='$senha'" or die("erro ao selecionar");
        $acao_sql = $mysqli->query($sql);

            if ($acao_sql=mysqli_num_rows($sql)>=0){

                setcookie("usuario",$usuario);
                header("Location:painel.php");

            }else{
                echo"<script language='javascript' type='text/javascript'>alert('Login e/ou senha incorretos');window.location.href='login.html';</script>";
                die();

            }
    }
?>

The problem is that whatever password and user I put, it enters the system (pane.php).

    
asked by anonymous 06.05.2014 / 23:21

2 answers

4

You're using comparison operator >= (Maior ou Igual) in the snippet, mysqli_num_rows($sql) >= 0 , that is, if it finds the user > maior do 0 , if it does not find, Igual a 0 , in this case, its if always returns true , and redirects to painel.php .

Additionally you need to mysqli_num_rows from the result of the query, that is, $acao_sql->num_rows .

Edit your code for:

if($acao_sql->num_rows == 1)

or

if($acao_sql->num_rows > 0)

    
06.05.2014 / 23:37
0

If you are using version (PHP 5> 5.5.0) strongly recommend using password_hash or if it is < 5.5.0, use phpass .

    
08.05.2014 / 04:26
How do I get a file extension? Enable input when clicking the button inside the same row of a table