User activation query with if

Question

Hi guys i have problem with my if conditional here is a query and script:

$sql_admin = "SELECT * 
                FROM users 
                WHERE username='$username' 
                AND hashed_password='$pass_admin' 
                AND lvl = 1 LIMIT 1";
$query_admin = mysqli_query($connection, $sql_admin);
$row_admin = mysqli_fetch_array($query_admin);
$id_admin           = $row_admin['id'];
$db_password_admin  = $row_admin['hashed_password'];
$lvl_admin          = $row_admin['lvl'];
$active_admin       = $row['active'];

if($pass_admin == $db_password_admin && $active_admin == 1) {
    $_SESSION['id'] = $id_admin;
    redirect_to("admin");
} elseif($pass_admin == $db_password_admin && $active_admin == 0) {
    echo '<script language="javascript">';
    echo 'alert("Your acc is not activated.");';
    echo 'window.location.href="index";';
    echo '</script>';
} else {
    // something other
}

When i try only $pass_admin == $db_password_admin that´s work, but when i add ( && $active_admin == 0/1 it´s not working.

Thank´s for answers.

For that code to work you must be Rolling Your Own password hashing. probably MD5() or SHA1() PHP provides [`password_hash()`](http://php.net/manual/en/function.password-hash.php) and [`password_verify()`](http://php.net/manual/en/function.password-verify.php) please use them. And here are some [good ideas about passwords](https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet) If you are using a PHP version prior to 5.5 [there is a compatibility pack available here](https://github.com/ircmaxell/password_compat) — RiggsFolly, Feb 23 '17 at 09:17
Your script is at risk of [SQL Injection Attack](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Have a look at what happened to [Little Bobby Tables](http://bobby-tables.com/) Even [if you are escaping inputs, its not safe!](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) Use [prepared parameterized statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) — RiggsFolly, Feb 23 '17 at 09:18

score 2 · Answer 1 · answered Feb 23 '17 at 09:14

2

The error happens because you are using $active_admin = $row['active']; when you should use $row_admin so change the line to

$active_admin = $row_admin['active'];

$row is never initiated but you used $row_admin to fetch data from your query

answered Feb 23 '17 at 09:14

Fabio

23,183
12
55
64

Thank you it´s work!! :) – Forlis Feb 23 '17 at 09:19
You are welcome dude – Fabio Feb 23 '17 at 09:19

User activation query with if

1 Answers1