0

I am trying to create a log in session that uses only a password field. This is just a hobby project but i am making a point of sale system that will allow bartenders to log in with a numeric password.

The form that i have is in /index.php

The password textbox is called "form_password"

The submit button on that form is called "submit_form_button"

The code that i have in the actions/login_action.php is below

    <?php
session_start();
if(isset($_POST['form_password'])){

  //submit button pressed
// make a variable out of the password field
$password = $_POST['form_password'];
//check if the password field is empty
if(empty($password)){
  //what to do if password field is empty
  header("Location: ../index.php?login=nopass");
  exit();
}else{
  //what to do if password field is not empty
  include 'dbconn.php';
  $sql = "SELECT * FROM pos_usr WHERE usr_pass = $password";
  $result = mysqli_query($conn, $sql);
  $row = mysqli_fetch_array($result);
  // echo "i have done the SQL <br/>";
  if (is_array($row)){
    //what to do if rows are found
    $_SESSION["user_name"] = $row['usr_name'];
    header("Location: ../home.php?logon=success");


  }else {
    //what to do if no rows are found=
    echo "no rows found";
  }

    }
}

I only ever get "no rows found"

I would appreciate any help that could be offered, i have been doing much research but have been unable to get this to work.

There is a user in my database with a password.

Kind Regards

Adam

This post was closed due to it being a duplicate, but this was not the case. The issue that i had, which is now fixed was due to the use of a same variable in one of the included files. Very amateur i know

Hopefully this can be reopened so that i can give thanks where it is due as var_dump really helped me.

I also added some additional error finders

ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

Thanks all for your help.

Adam Hewitt
  • 11
  • 1
  • Have you tried printing `$row`? (`var_dump($row)`) – Sam Jun 30 '18 at 20:15
  • `if (is_array($row)){` change this to `if ($row){`. By default result is in object form and you are checking for array. – Naveed Ramzan Jun 30 '18 at 20:28
  • 1
    `$sql = "SELECT * FROM pos_usr WHERE usr_pass = '$password' "` But that leaves the code wide open to [SQL Injection Attack](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Even [if you are escaping inputs, its not safe!](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) Use [prepared parameterized statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) in either the `MYSQLI_` or `PDO` API's – RiggsFolly Jun 30 '18 at 22:44

0 Answers0