php wont connect to mysql and query for user/pass

Question

I am trying to get the php/mysql to work so that it will take the username and password from a form and check if they are in the mysql table. If they are in the table it should log you in and send you to the index.php page(I changed the user/pass/database)

The form on the login page:

    <form action="db_connect.php" method="post">
    <input type="text" name="username" placeholder="Username" />
    <input type="password" name="password" placeholder="Password" />
    <input type="submit" value="Login" class="customButton" />
    </form>

The db_connect.php:

    <?php 
    $username = $_POST['username'];
    $password = $_POST['password'];
    $con = new mysqli_connect("localhost","user","password","database");
    $query = mysqli_query($con,"SELECT * FROM members WHERE username='".$username."' AND password='".$password."'");
    if (mysqli_num_rows($query) != 0){
        $_SESSION['logged_in'] = true;
        header('Location: index.php');
    }else{
        echo "Access denied";
    }
?>

Answer 1

My thoughts:

Your query can be

$query = mysqli_query($con,"SELECT * FROM members WHERE username = '$username'");

to avoid ' ' mistakes.

Use session_start() before managing sessions

Also, try typing this query on your Database Tool (eg. Phpmyadmin, HeidiSQL etc..) and see if any results come out.

If it does you can try using PDO objects for creating connection with the database.

Do you get "Acess denied" when submitting the form or PHP dump log?

Answer 2

This code should work for you.

Login page:

<form action="db_connect.php" method="POST">
<input type="text" name="username" placeholder="Username" />
<input type="password" name="password" placeholder="Password" />
<input type="submit" value="Login" class="customButton" />
</form>

In the PHP file, we are starting a new session initially & then reporting all the errors if generated.Then we are escaping the input strings to avoid injection.Then we are checking whether the username & password sent via $_POST is set or not. Then checking the input values with our database and finally redirecting the user to his personalized index.php

db_connect.php

<?php
session_start();
error_reporting(E_ALL); ini_set('display_errors', 1);
$con = mysqli_connect("localhost","user","password","database");
$username = $_POST['username'];
$password = $_POST['password'];
$username = mysqli_real_escape_string($con, $username);
$password = mysqli_real_escape_string($con, $password);
if(isset($username) && isset($password)){

$query = mysqli_query($con,"SELECT * FROM members WHERE username='".$username."' AND password='".$password."'");
if (mysqli_num_rows($query) > 0){
    $_SESSION['logged_in'] = $user;
    header("location: index.php");
}else{
    echo "Access denied";
} } else { header("location: login.php"); }
?>

Answer 3

Step #1

Turn on error reporting to assist with the debugging of this issue.

<?php 
error_reporting(E_ALL);
ini_set('display_errrors', 1);
mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
?>

Step #2

Sanatize any AND all user input. Since you are using mysqli(), you'd be using something like mysqli_real_escape_string().

Now there is one clear mistake straight off the bat, as Fred -ii- stated; since you are dealing with sessions, you'd need to instantiate it first.

An example of that would be putting something like this for your login script.

<?php 
    session_start();
?>

Now the second error is that you're treating/ trying to instantiate mysqli_connect() as a class, which is is not. Your login code should look something like this:

<?php

session_start();

$con = mysqli_connect("localhost", "user", "password", "database") or die(mysqli_error($con));

$username = $_POST['username'];
$password = $_POST['password'];
$username = mysqli_real_escape_string($con, $username);
$password = mysqli_real_escape_string($con, $password);
if (isset($username) && isset($password)) {

    $query = mysqli_query($con, "SELECT * FROM members WHERE username='" . $username . "' AND password='" . $password . "'");
    if (mysqli_num_rows($query) > 0) {
        $_SESSION['logged_in'] = true;
        header("location: index.php");
    } else {
        echo "Access denied";
    }
}
?>

Needless to say that your index.php will need session_start() at the top of it to ensure you can check $_SESSION['logged_in'] like:

<?php 
session_start();
if(!$_SESSION['logged_in']) {
    die('login.php');
}
?>