1

I am trying to make a remember me option in my login form. Each time I try to update table with the token value, this value specifically does not update and always return empty after the update process, although the cookies and sessions are already created. Here is my php code.

<?php
$dbc=mysqli_connect('localhost','root','','store') or die('Can\'t connect.');
session_start();+
{
if(isset($_POST['submit_login'])) {
    $login_username=$_POST['user_name_login'];
    $login_password=$_POST['password_login'];
    $statement=mysqli_stmt_init($dbc);
    if (mysqli_stmt_prepare($statement, "SELECT * FROM customers_info WHERE user_name=?")) {
        mysqli_stmt_bind_param($statement,"s",$login_username);
        mysqli_stmt_execute($statement);
        $result=mysqli_stmt_get_result($statement);
        $num=mysqli_num_rows($result);
    }
    if($num==1) {
        while ($row=mysqli_fetch_assoc($result)) {
            $user_name=$row['user_name'];
            $enc_user_name=password_hash($user_name,PASSWORD_DEFAULT);
            $user_friend=bin2hex(random_bytes(32));
            $token=password_hash($user_friend);
            $user_signature="$enc_user_name"."___"."$user_friend";

//=====================================================================
            if(password_verify($login_password,$row['password'])) {
                $_SESSION['user_name']=$user_name;
                if(isset($_POST['rememberme'])) {
                    mysqli_query($dbc,"UPDATE customers_info 
                                        SET myenc='$token' 
                                        WHERE user_name='$user_name'");

                    setcookie('cats_love_balls',$user_signature,(time()-3600));
                }
                header('Location: myfile.php');
            }

//===================================================================

        }
    }

} else {
    echo 'not found';
}

}
?>

and here is the mysql statement for creating mytable:

CREATE TABLE `customers_info` (
 `user_name` varchar(50) NOT NULL,
 `password` varchar(255) DEFAULT NULL,
 `first_name` varchar(50) DEFAULT NULL,
 `last_name` varchar(50) DEFAULT NULL,
 `email` varchar(100) DEFAULT NULL,
 `myenc` varchar(300) DEFAULT NULL,
 PRIMARY KEY (`user_name`)
);

I do not know if this is important,but i am using Ubuntu 16.04 if you please, I need your help to solve my issue.

RiggsFolly
  • 93,638
  • 21
  • 103
  • 149
kimokimo
  • 11
  • 1
  • 2
    `session_start();+` what's that `+` doing there? – Qirel Jul 16 '17 at 16:28
  • 2
    Use PHP error-reporting by adding `error_reporting(E_ALL); ini_set('display_errors', 1);` after the opening PHP tag ` – Qirel Jul 16 '17 at 16:29
  • Some sensible code indentation would be a good idea. It helps us read the code and more importantly it will help **you debug your code** [Take a quick look at a coding standard](http://www.php-fig.org/psr/psr-2/) for your own benefit. You may be asked to amend this code in a few weeks/months and you will thank me in the end. – RiggsFolly Jul 16 '17 at 16:37
  • 1
    Your script is at risk of [SQL Injection Attack](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Have a look at what happened to [Little Bobby Tables](http://bobby-tables.com/) Even [if you are escaping inputs, its not safe!](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) Use [prepared parameterized statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) – RiggsFolly Jul 16 '17 at 16:40
  • 1
    You have a few coding errors, so follow @Qirel suggestion and add some error reporting, but also add `mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);` – RiggsFolly Jul 16 '17 at 16:45
  • @Qirel thanks for your reply,I already tried debugging as you mentioned above. But still the same issue. only the status of the myenc column- which i save the hashed value in - is changed from null to empty.Really, I tried many possible causes,but it failed. I do not know what is the reason.regarding the (+) sign beside session start. it was inserted by mistake while copying the code and not found in my script – kimokimo Jul 17 '17 at 03:52

0 Answers0