I have this code for my login test but sadly, my hash (md5) when once compared to the one record (if exist) that match the login data that has been pass through my login parameters. (refer to the code below) it always return $error = "Invalid username or password" but when i tried to remove the md5 hashing and make my password flat (none hashed) and it work which supposedly I dont want to flat my password for security purpose.
//check if there is post request named username and password
if (isset($_POST['username']) || isset($_POST['password'])){
//check if username and password is empty
if ($_POST['username'] === "" || $_POST['password'] === ""){
$error = "Username or password must not be empty.";
} elseif (preg_match('`^[a-zA-Z0-9_]@{1,}$`', $_POST['username'])) {
// check if username contains other than number, letters and underscore
$error = "Username must only letters, underscore and numbers!";
exit;
}else{ //not empty then check in database
//filter username and password to avoid sql injections
$username = htmlspecialchars(stripslashes($_POST['username']));
$password = htmlspecialchars(stripslashes($_POST['password']));
$password = md5($password);
$sql = "SELECT id from user WHERE username='$username' and password='$password'";
//checking if the username is available in the table
$result = mysqli_query($db,$sql);
$count_row = $result->num_rows;
if ($count_row == 1) {
$_SESSION['login'] = true;
header('location: home.php');
exit;
}else{
$error = "Invalid username or password";
} //end of else if theres no record found.
} //end of else isset username and password
}//end of isset username and password
and also this line
} elseif (preg_match('`^[a-zA-Z0-9_]@{1,}$`', $_POST['emailusername'])) {
// check if username contains other than number, letters and underscore
echo "Username must only letters, underscore and numbers!";
exit;
doesnt work too, as you see from above reference code line, it must check if username contains other than number, letters and underscore and then throw an error if username contains other than number, letters and underscore yet it always return $error="Username must only letters, underscore and numbers!";
any help, ideas, clues will be greatly appreciated. Thank you!
