error_log stating variables aren't defined

Question

So I've been working on my php code and currently I'm facing an issue where the error_log keeps implying that my variables aren't defined.

I had a look at PHP: "Notice: Undefined variable", "Notice: Undefined index", and "Notice: Undefined offset".

Unfortunately, it didn't seem to make any difference.

Error_Log

[13-Feb-2018 11:01:44 America/New_York] PHP Notice:  Undefined variable: email in /home/beaspsaq/imgs/php/login.php on line 36
[13-Feb-2018 11:01:44 America/New_York] PHP Notice:  Undefined variable: con in /home/beaspsaq/imgs/php/login.php on line 37
[13-Feb-2018 11:01:44 America/New_York] PHP Warning:  mysqli_query() expects parameter 1 to be mysqli, null given in /home/beaspsaq/imgs/php/login.php on line 37
[13-Feb-2018 11:01:44 America/New_York] PHP Warning:  mysqli_num_rows() expects parameter 1 to be mysqli_result, null given in /home/beaspsaq/imgs/php/login.php on line 38
[13-Feb-2018 11:01:44 America/New_York] PHP Notice:  Undefined variable: con in /home/beaspsaq/imgs/php/login.php on line 81
[13-Feb-2018 11:01:44 America/New_York] PHP Warning:  mysqli_close() expects parameter 1 to be mysqli, null given in /home/beaspsaq/imgs/php/login.php on line 81
[13-Feb-2018 11:01:45 America/New_York] PHP Notice:  Undefined index: remember_me in /home/beaspsaq/imgs/php/login.php on line 16
[13-Feb-2018 11:01:45 America/New_York] PHP Warning:  mysqli_connect() expects parameter 5 to be long, string given in /home/beaspsaq/imgs/php/login.php on line 28

PHP

<?php
  session_start();

    if(isset($_SESSION["id"]) || isset($_COOKIE["id"])) {
        header("Location: dashboard.php");
    }

    if(isset($_POST["login"]))  {
        //Gather input variables
        $email = isset($_POST['email']) ? $_POST['email'] : '';
        $password = isset($_POST["password"]) ? $_POST['password'] : '';
        //Hash password as pasword should be hashed in database for security reasons.  See md5 hashing
        $hash_password = md5($password);
        $remember_me = $_POST["remember_me"];

        //Connect to Database
        $host="-";      
        $username="-"; 
        $password="-"; 
        $db_name="-"; 
        $tbl_name="-"; 

        $con = mysqli_connect("-","-","-","-","-")or die("cannot connect: " . mysqli_connect_error());
        mysqli_select_db("$db_name")or die("cannot select DB");
    }

    //Check database to see if email registered to DB
    $sql = "SELECT id FROM users WHERE email='$email' LIMIT 1";
    $query = mysqli_query($con, $sql);
    $count_users = mysqli_num_rows($query);

    if( $count_users == 1 ) {

        //Retrieve user details to perform login
        $sql = "SELECT * FROM users WHERE email='$email' LIMIT 1";
        $query = mysqli_query($con, $sql);
        while($row = mysqli_fetch_array($query)) {
            $user_id = $row["id"];
            $user_password = $row["password"];
        }


        if($hash_password == $user_password) {
            if($remember_me == 1) {
                //Set Cookie
                $cookie_name = "id";
                setcookie($cookie_name, $user_id, time() + (86400 * 30), "/");

                header("Location: dashboard.php");
            } else {
                //Set Session
                $_SESSION["id"] = $user_id;
                header("Location: dashboard.php");
            }
        } else {
            $error = '<p class="error">Password incorrect.</p>';
        }
    } else {
        $error = '<p class="error">Email address not registered.</p>';
    }

    mysqli_close($con); 
?>

`//Hash password as pasword should be hashed in database for security reasons. See md5 hashing` ... you know that episode of The Simpsons, the Cape Fear spoof where Sideshow Bob stands on rake after rake after rake on the deck of the boat and goes "Eugheueueueueuh" over and over again... try [password_hash](http://php.net/manual/en/function.password-hash.php) ... you're also wide open to SQL injection. — CD001, Feb 13 '18 at 16:45

score 0 · Answer 1 · answered Feb 13 '18 at 16:17

0

Once you have $_POST["login"] you initiating $email and DB connection. But you not always have POST. And you start using DB connection no matter do you have it initiated or not.

answered Feb 13 '18 at 16:17

Oleg Butuzov

4,795
2
24
33

score 0 · Answer 2 · answered Feb 13 '18 at 16:33

0

declare and initialize your $email and your database connection before if(isset($_POST["login"])){ .. }

answered Feb 13 '18 at 16:33

Sofyan Thayf

1,322
2
14
26

error_log stating variables aren't defined

2 Answers2