Log in form using php and mysql isnt working?

Question

ive been trying for a few hours now and i cannot seem to get this code to work.

Bascially i a have a bookings page where you enter your details, from this i set the account password as the phone number(just to make it easier) and then after they make a booking it will add their details to a table in phpmyadmin.

I then want to have a log in page where they can log in using their email and their password(which is their phone)

I am trying to get it so in my login.php it includes a login form which just is a form to enter the email and password(phone) and then that form will go into the login.php and if the account email and password are the same in the bookings table in phpmyadmin it will send them to view.php this will then print them their booking detials.

Any help would be great on how i can go about doing this, thanks.

Here is my login.php

<?php require_once('includes/dbconn.php');
session_start();
$_COOKIE['active']=='no';
function randomPass() {
    $chars = "abcdefghijklmnopqrstuvwxyz0123456789";
    for ($i=1;$i<=8;$i++) {
        $num = rand(0,35);
        $tmp = $chars{$num};
        $pass .= $tmp;
    }
    return $pass;
}



if ($_COOKIE['active']=='no') {

    if (isset($_POST['rpemail'])) {
        $checkemail_sql = sprintf("SELECT * FROM bookings WHERE
booking_email = '%s'", $_POST['rpemail']);
        $email_query = mysqli_query($dbconn, $checkemail_sql) or die(mysqli_error());
        $email_check = mysqli_num_rows($email_query);
        if ($email_check == 0) {
            $error = '<p class="full">That email address does not exist in our
    database, please enter the email address that you used when booking
    your tour.<p>';

            include('includes/activateform.php');

        } else {

            $password = randomPass();
            $db_password = md5($password);
            $addpass_sql = sprintf("UPDATE bookings SET acc_password='%s', acc_active=1 WHERE booking_email = '%s'", $db_password, $_POST['rpemail']);
            $addpass_query = mysqli_query($dbconn, $addpass_sql) or die(mysqli_error());
            $subject = "MBM Password Information";
            $header = "info@mbm.co.nz";
            $message = "Thank you for registering at our website,
                 http://www.mbm.co.nz!\n\n
                 To access the bookings area, use the following information:\n\n
                 Username: ".$_POST['rpemail']."\n
                 Password: $password\n\n
                 Thanks!\n
                 The Webmaster\n\n
                 This is an automated response, please do not reply!";
            mail($_POST['rpemail'], $subject, $header, $message);
            setcookie('active', 'yes', time()+31536000);

        }
    } else {

        include('includes/activateform.php');
    }
}

if ($_COOKIE['active'] == 'yes' && isset($_POST['email']) && isset($_POST['password'])) {

    $email = $_POST['email'];
    $password = md5($_POST['password']);
    $checklogin_sql = sprintf("SELECT * FROM bookings WHERE booking_email = '%s' AND acc_password = '%s' AND acc_active = '1'", $email, $password);
    //echo $checklogin_sql;
    $login_query = mysqli_query($dbconn, $checklogin_sql) or die(mysqli_error());
    $login_check = mysqli_num_rows($login_query);


    //            die('lol');
    // if ($login_check != 0) {

        $_SESSION['useremail'] = $email;
        header("Location: view.php");
        exit;
    }

?>

here is the loginform.php in my loginform.php i didnt really know how to echo out the things in the database so i was just trying a few differant things.

<div id="enquiry">

      <h2>Please login </h2>
      <p> Please login to check your booking.</p>
      <form id="fmLogin" name="fmLogin" method="post" action="login.php">
        <div class="row"><span class="label">Email:</span><span class="element">
          <input name="email" type="text" id="email" />
        </span></div>
        <div class="row"><span class="label">Password</span><span class="element">
          <input name="password" type="password" id="password" />
          </span></div>
        <div class="row"><span class="label">&nbsp;</span><span class="element">
          <input name="submit" type="submit" id="submit" value="Login" />
          </span></div>
      </form></div>
</div>

here is my view.php

<div id="enquiry">
         <h2>Your bookings</h2> 
            <div class="row">
                <span class="label">Tour:</span> <span class="element">Mission name, Mission date</span>
            </div>
            <div class="row">
                <span class="label">Number of riders:</span> <span class="element"><span class="row"><span class="element">1</span></span></span>
            </div>

            <div class="row">
                <span class="label">Name:</span> <span class="element"><?php echo $rsMissions['missions_name']; ?></span>
            </div>

            <div class="row">
                <?php echo $rsMissions['phone'];?>
            </div>

            <div class="row">
                <span class="label">Email:</span> <span class="element">user@home.org</span>
            </div>
            <div class="row">
                <span class="label">&nbsp;</span><span class="element">&nbsp;</span>
            </div>
        </div>

off-topic: MD5 is not a secure method to store passwords in a database. Please have a look at [password_hash](http://php.net/manual/en/function.password-hash.php). Your code is also vulnerable to SQL injection, instead of replacing placeholders yourself, you should use prepared statements — DarkBee, Jul 04 '16 at 10:30
Use password_hash and password_verify (a.k.a. best practices). Examples in mysqli and pdo link at the bottom [here](http://stackoverflow.com/a/33665819) — Drew, Jul 04 '16 at 14:36

score 1 · Accepted Answer · answered Jul 04 '16 at 10:27

I can't speak for the rest of the code: but you are checking for

if (isset($_POST['rpemail'])) {

but the email that in your posted form is

<input name="email" type="text" id="email" />

These will need to be the same

if (isset($_POST['email'])) {

also you are concatenating $pass, but it isn't defined (unless it is in the required file):

$pass .= $tmp;

should simply be

$pass = $tmp;

Log in form using php and mysql isnt working?

1 Answers1