0

I have this error that says

Notice: Undefined index: uname in C:\xampp\htdocs\TI\TrackIt!\System\LOG.php on line 33 Notice: Undefined index: pword in C:\xampp\htdocs\TI\TrackIt!\System\LOG.php on line 34

And now what is happening to my Log Page is that it accepts any username or pword. I've searched through the asked questions, and nothing's really helping. here's my code:

<form class="form-signin" role="form" action='CUSTOMER.php' method="POST">
<input type="text" class="form-control" name="uname" id="uname" placeholder="Username" required autofocus>
<input type="password" class="form-control" name="pword" id="pword" placeholder="Password" required>
<button class="btn btn-lg btn-primary btn-block" type="submit">Login</button>
</form>

Here's the PHP:

$myusername = $_POST['uname']; 
$mypassword = $_POST['pword'];
$DPassword = md5($mypassword); 

$sql = "SELECT uname, pword
  FROM Admin
  WHERE uname = '".$myusername."'
        AND Pword ='".$DPassword."'
         ";

$result=mysql_query($sql) OR die('error: '.mysql_error());
$row = mysql_fetch_array($result);
$count=mysql_num_rows($result);
if($count == 1){
  session_regenerate_id(true);
  $session_username = $myusername;
  $session_name = $row["name"];
  $_SESSION['uname'] = $session_username;
  $_SESSION['name'] = $session_name;
}
elseif(strlen($myusername) >= 2 && strlen($mypassword)>= 2)  
{
  echo "<script> alert('WRONG USERNAME OR PASSWORD'); </script>";
}
ob_end_flush();
googlelord
  • 15
  • 2
  • I would firstly not use md5(). It can be cracked very easily....try looking at sha and having a salt added. Also use mysqli not mysql. Is line 34 and 35 the two middle lines you specified in your first code comment – lecardo Apr 14 '15 at 20:23
  • Stop hashing your own passwords, use [`password_hash()`](http://php.net/manual/en/function.password-hash.php). Also learn to use query parameters to avoid SQL injection. – Sammitch Apr 14 '15 at 20:26
  • Encryption doesn't matter, its just a school project. Thank you for pointing that out. What do you mean by MYSQLI? I'm confuse. and yes, they're the code specified. – googlelord Apr 14 '15 at 20:26

0 Answers0