Usernames and passwords from database with php

Question

I am trying to check usernames and passwords with my database. However each time i attemp to login with my "admin" accounts using the password "12341" it won't give me the results I want.

login.php

<div align="center" position="fixed" >  
     <form action="login_process.php" method="post">  
        <input name="username" type="text" value="" size="9"><br>  
        <input name="pass" type="password" value="" size="9"><br>  
        <input type="submit" value="Log in">  
     </form>  
</div>

login_process.php

require_once('db_conn.php');



if (!isset($_POST['username']) || !isset($_POST['pass'])) {  
    echo 'U moet een gebruikersnaam en wachtwoord invoeren!';  
    exit;  
}

$sql = "SELECT `username`,`password` \n"
. "FROM `tryusers` \n"
. "WHERE `username` = \'Admin\'\n"
. "AND `password` = \'12341\'";
$sql = "SELECT `username`,`password` FROM `tryusers` WHERE `username` = " . $_POST['username'] . " AND password = " . $_POST['pass'] . "";
$results = $conn->query($sql);
    var_dump('postuser',$_POST['username'],'<br>');
    var_dump('postpass',$_POST['pass'],'<br>');
if(!$results){
    echo 'no results';
} else {
    echo $results;
}

db_conn.php

$servername = "localhost";
$username = "root";
$password = "";
$dbname = "trybase";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}

Any help is appreciated.

Regards, Sem

1) used prepared statements against SQL injections. 2) Check the error messages after the queries. — Sirko, Feb 04 '15 at 10:08

score 0 · Accepted Answer · answered Feb 04 '15 at 10:08

0

You have to make quotes arround the variables:

$sql = "SELECT `username`,`password` FROM `tryusers` WHERE `username` = '" . $_POST['username'] . "' AND password = '" . $_POST['pass'] . "'";

Or better use prepared statements.

answered Feb 04 '15 at 10:08

Jens

67,715
15
98
113

Ugh. So simple, overlooked that. Thanks. – Sem Abraham Feb 04 '15 at 10:19

score 0 · Answer 2 · edited May 23 '17 at 12:06

0

you forgotten ' when pasting data from the form. Btw check this because your code is dangerous.

edited May 23 '17 at 12:06

Community

1
1

answered Feb 04 '15 at 10:12

Janusz Chodzicki

25
3

I'm quite new to using databases, and I wasn't fully informed on the SQL injections thing. So I'll definitly put that in. Thanks/ – Sem Abraham Feb 04 '15 at 10:19

Usernames and passwords from database with php

2 Answers2