Server Error or Android Issue?

Question

I am working on a login/register app. That's my Java Code in my MainActivity:

private void loginUser(){
    pd = ProgressDialog.show(LoginActivity.this, "", "Loading...");
    StringRequest stringRequest = new StringRequest(Request.Method.POST, LOGIN_URL,
            new Response.Listener<String>() {
                @Override
                public void onResponse(String response) {
                    try {
                        JSONObject jsonResponse = new JSONObject(response);
                        System.out.println("JSON RESPONSE: " + jsonResponse.toString());
                        boolean success = jsonResponse.getBoolean("success");
                        if (success) {
                            launchHomeScreen();
                            pd.dismiss();
                            Toast.makeText(LoginActivity.this,"Welcome back " + username,Toast.LENGTH_LONG).show();
                        }
                        else {
                            Toast.makeText(LoginActivity.this,"Wrong Username or Password!",Toast.LENGTH_LONG).show();
                            pd.dismiss();
                        }
                    }
                    catch (JSONException e) {
                        e.printStackTrace();
                        pd.dismiss();
                        Toast.makeText(LoginActivity.this,response,Toast.LENGTH_LONG).show();
                    }
                }
            },
            new Response.ErrorListener() {
                @Override
                public void onErrorResponse(VolleyError error) {
                    pd.dismiss();
                    System.out.println("Error: " + error);
                }
            }){
        @Override
        protected Map<String,String> getParams(){
            Map<String,String> params = new HashMap<>();
            params.put(KEY_USERNAME,username);
            params.put(KEY_PASSWORD,password);
            return params;
        }

    };
    RequestQueue requestQueue = Volley.newRequestQueue(this);
    requestQueue.add(stringRequest);
}
}

---

login.php:

<?php
$con = mysqli_connect("x", "x", "x", "x");

$username = $_POST["username"];
$password = $_POST["password"];

$statement = mysqli_prepare($con, "SELECT * FROM user WHERE username = ?");
mysqli_stmt_bind_param($statement, "s", $username);
mysqli_stmt_execute($statement);
mysqli_stmt_store_result($statement);
mysqli_stmt_bind_result($statement, $colUserID, $colUsername, $colPassword);

$response = array();
$response["success"] = false;  

while(mysqli_stmt_fetch($statement)){
    if (password_verify($password, $colPassword)) {
        $response["success"] = true;  
    }
}
header('Content-Type: application/json');
echo json_encode($response);
?>

The mysql table looks like: user_id;username;passsword;mobilenumber;email

When i trying to login I get this back in Android logcat, so that error is caused by writting the LOGIN_URL wrong.

E/Volley: [251] BasicNetwork.performRequest: Unexpected response code 404 for http://myserver.xyz/pubic_html/login.php
I/System.out: Error: com.android.volley.ServerError

But there is another Error. I send the right logindatas to the server but everytime I get back success:false.

The weird thing is that I use a similar java code for registration (only with a register.php), and it works, so what is wrong?

This is register.php

<?php
    $connect = mysqli_connect("localhost", "root", "", "user");

    $username = $_POST["username"];
    $password = $_POST["password"];
    $hashedPassword = password_hash($password, PASSWORD_BCRYPT);
    $mobilenumber = $_POST["mobilenumber"];
    $email = $_POST["email"];

    registerUser();
    $response["success"] = false; 
    function registerUser() {
        global $connect, $username, $hashedPassword, $mobilenumber, $email;
        $statement = mysqli_prepare($connect, "INSERT INTO user (username, hashedPassword, mobilenumber, email) VALUES (?, ?, ?, ?)");
        mysqli_stmt_bind_param($statement, "siss", $username, $hashedPassword, $mobilenumber, $email);
        mysqli_stmt_execute($statement);
        mysqli_stmt_close($statement);  
        $response["success"] = true; 
    }
    header('Content-Type: application/json');
    echo json_encode($response);
?>

Answer 1

404 means the app cannot find the login.php page. Make sure your path to the script is correct.

Try removing the "public_html" from the link. That is your root folder. You do not need to specify this in your link. It should work if you remove that.

EDIT

Since you edited your post after I answered that question, let me edit mine to answer your next. Judging from the password_very function in you php file, you are using password_hash and your password is encrypted with password_hash('yourPass', PASSWORD_BCRYPT);?

In this case, I do not see that you included the library in you PHP script. Just add the following line to your php file and it should work.

include('path/to/password_hash.php');

The problem is, because the file is not found, password_verify is not recognized. I am sure if you change $_POST['username'] and $_POST['password'] to 'YourUsername' and 'YourPassword' and run your file from a browser, you will see all errors, and that will be one of them.

Hope this helps!

EDIT 2

Since you are having issues with the password. In your statement where you insert the password to the database use the password_hash function to hash the password BEFORE you insert it to the database like so:

$hashedPassword = ('Yourpassword', PASSWORD_BCRYPT);

Do your MySQL query and add the $hashedPassword value to the database in the password field. Then retrieve the password and username like you did at the very beginning and use the password_verify function to match the passwords like so:

if (password_verify($_POST['password'], $hashedPassword) {
    // Do your login stuff.
}

Now it should login. (Optional Extra) Also, try looking at PDO to do your sql queries. It is much better. To use PDO do the following:

    //Initiate Connection
        $conn = new PDO('mysql:host='.$db_host.';dbname='.$db_name, $db_user, $db_password);

$stmt = $conn->prepare("SELECT password FROM user WHERE username = :username");

if ($stmt->execute(array(':username' => $_POST['username']))) {
    if ($result = $stmt->fetch(PDO::FETCH_ASSOC)) {
        $passwordFromDb = $result['password']; //This is the password you match in password verify. This password should be hashed in the database. if it is hashed it will look something like this - $2y$07$BCryptRequires22Chrcte/VlQH0piJtjXl.0t1XkA8pw9dMXTpOq.
    }
}

The problem I think is that you have 'Geige' stored as your password in the database and not that hashed string. So when the password_verify function tries to match the passwords, it fails. Your code might be right, but the password in the database might be wrong. When inserting the password to the database, make sure you are hashing it and inserting the hashed password.

I really hope this helps.

EDIT 3 Register Rewrite

<?php
    //Initiate Connection
    $conn = new PDO('mysql:host='.$db_host.';dbname='.$db_name, $db_user, $db_password);

    $username = $_POST["username"];
    $password = $_POST["password"];
    $hashedPassword = password_hash($password, PASSWORD_BCRYPT);
    $mobilenumber = $_POST["mobilenumber"];
    $email = $_POST["email"];

    $stmt = $conn->prepare("INSERT INTO user (username, hashedPassword, mobilenumber, email) VALUES (:username, :password, :mobile, :email)");

    if ($stmt->execute(array(':username' => $username, ':password' => $hashedPassword, ':mobile' => $mobilenumber, ':email' => $email))) {
        $response["success"] = true; 
    } else {
        $response["success"] = false; 
    }

    header('Content-Type: application/json');
    echo json_encode($response);
?>