How do I properly determine if an array that is returned is false?

Question

I am attempting to build a password-protected area on my site. However, in my if statement, I'm having trouble determining if the array is empty or not. When the code is run, regardless of what is put into the user/pass fields, it's always testing as true. For reference, the database being accessed only has 1 row, containing 1 user/pass combo.

function verify(){

  $dbhost = "host";
  $dbname = "db";
  $dbuser = "user";
  $dbpass = "password";


  if (isset($_SESSION['valid_user']))return true;

  $user_name = $_POST["user_name"]; 
  $password = $_POST["password"];

  if ($user_name && $password){ 

    try{ 
      $conn = new PDO("mysql:host=$dbhost;dbname=$dbname",$dbuser,$dbpass);
    }
    catch(PDOException $pe){
      die('Connection error, because: ' .$pe->getMessage());
    }

    $sql = "SELECT user_name FROM users WHERE user_name = ':user_name' AND password = ':password'";     

    $q = $conn->prepare($sql);

    if(!$q){
      die("Execute query error, because: ". $conn->errorInfo());
    }; 

    $q->execute(array(':user_name'=>$user_name, ':password'=>$password));  

    $result = $q->fetchALL();

    if ($result['user_name']=$user_name){ 
      $valid_user = $user_name;
      $_SESSION['valid_user'] = $valid_user;
      return true;
    }
    else{  
      $text = "User Name and Password did not match";
      write_log_in($text);
    }
  }
  else {  
    $text = "This is a secure server. Please log in.";
    write_log_in($text);
  }
}

As a side note, I'm aware that my passwords should be stored in at least an MD5 hash format or something similar. I just wanted to get it working at all before adding in more stuff.

`if ($result['user_name']=$user_name){ ` should be `if ($result['user_name']==$user_name){ ` - you're mixing up assignment and comparison operators. — andrewsi, Apr 18 '13 at 17:34
for info, you can check if a variable is an array with is_array($var) - http://php.net/manual/en/function.is-array.php — RafH, Apr 18 '13 at 17:38
@andrewsi Thanks for the response, got it fixed now. --RafH Thanks, will read up on that. — Ryan, Apr 18 '13 at 17:52

score 2 · Accepted Answer · answered Apr 18 '13 at 17:35

2

This is your problem

if ($result['user_name']=$user_name){

it should be

if ($result['user_name']==$user_name){

But why you don't check if you have a result to determine if the user is correct. Because you pass the user in your SQL query.

answered Apr 18 '13 at 17:35

TheEwook

11,037
6
36
55

Thanks for the response. I think what you suggested was what I initially tried. But I was not sure how to check whether the query found results or not. – Ryan Apr 18 '13 at 17:49

score 1 · Answer 2 · answered Apr 18 '13 at 17:35

1

Missing an equal sign:

if ($result['user_name'] == $user_name){ 
// ----------------------^

answered Apr 18 '13 at 17:35

SeanWM

16,789
7
51
83

Thanks for the response, fixed now. – Ryan Apr 18 '13 at 17:49

Blender · Answer 3 · 2013-04-18T17:40:57.440

1

$result['user_name']=$user_name should be $result['user_name'] === $user_name.

Also, don't use MD5. Hash the passwords with a slow hashing function like hash_pbkdf2, which is expensive to attack.

edited Apr 18 '13 at 17:40

answered Apr 18 '13 at 17:35

Blender

289,723
53
439
496

The author noted at the bottom of his post that he is aware of this – Pankrates Apr 18 '13 at 17:38
@Pankrates: It doesn't hurt to suggest something better than MD5. – Blender Apr 18 '13 at 17:39
very true, although the focus on a different hashing mechanism did not really transpire from your remark immediately ;) – Pankrates Apr 18 '13 at 17:40
Thanks for the advice, I will read up on that method when I'm ready to try it. – Ryan Apr 18 '13 at 17:46

score -1 · Answer 4 · answered Apr 18 '13 at 17:43

-1

You could go with : if (mysql_num_rows($result)==0) because if there is no reslut, the user with the entered passwd is incorrect

answered Apr 18 '13 at 17:43

nicomaquemtl

9
2

He's not using mysql_*, though - it's using PDO. – andrewsi Apr 18 '13 at 17:53
I was able to find some alternatives using PDO to do the same thing which may prove useful. [link](http://stackoverflow.com/questions/11305230/alternative-for-mysql-num-rows-using-pdo) – Ryan Apr 18 '13 at 18:11

How do I properly determine if an array that is returned is false?

4 Answers4