0

I'm developing a login for my android studio project. I have my user_control on 000webhost. Here is that code

<?php
header('Content-type: application/json');
require_once 'connection.php';

class User { 

    private $db;
    private $connection;

    function __construct() { 
        $this->db = new DB_Connection();
        $this->connection = $this->db->get_connection();
    }

    public function does_user_exist($email, $password) { 
        $query = "Select * from users where email = '$email' and password = '$password' ";
        $result = mysql_query($this->connection, $query);
        if(mysqli_num_rows($result) > 0) { 
            $json['success'] = 'Welcome ' .$email;
            echo json_encode($json);
            mysqli_close($this->connection);
        }else { 
            $query = "Insert into users(email, password) values ('$email', '$password')";
            $is_inserted = mysqli_query($this->connection, $query);
            if($is_inserted == 1) { 
                $json['success'] = 'Account created, welcome '+ $email;
            } else { 
                $json['error'] = 'Wrong password';
            }

            echo json_encode($json);
            mysql_close($this->connection);

        }
    }
}

$user = new User();
if(isset($_POST['email'],$_POST['password'])) {
    $email = $_POST['email'];
    $password = $_POST['password'];

    if(!empty($email) && !empty($password)) { 
        $encrypted_password = md5($password);
        $user -> does_user_exist($email, $encrypted_password);
    } else { 
        echo json_encode("You must fill both fields.");

    }
}?>

The error showing is $this->connection = $this->db-get_connection();, however I cannot figure it out. Is there a $ missing I should see? I have got some other files but I don't think they are affecting it. I can post them if needed.

  • I just read this could be my PHP version. Is there any free hosting with a supported PHP version? – Dáithí Cushen Dec 10 '17 at 22:00
  • The code is also open to SQLi, try it, enter in email field: `x' or '1'='1';--`, then any password, you also have `'Account created, welcome '+ $email;` which is not right. – Lawrence Cherone Dec 10 '17 at 22:05
  • That's not version dependant. See "Syntax error does not transmit over the web". – mario Dec 10 '17 at 22:12

0 Answers0