16

I just upgraded my PHP installation from version 5.6 to 7.2. I used the count() function on my login page like so:

if (!empty($_POST['username']) && !empty($_POST['password'])):
    $records = $conn->prepare('SELECT id,username,password FROM users WHERE username = :username');
    $records->bindParam(':username', $_POST['username']);
    $records->execute();
    $results = $records->fetch(PDO::FETCH_ASSOC);

    $message = '';
    
    if (count($results) > 0 && password_verify($_POST['password'], $results['password'])) {
        $_SESSION['user_id'] = $results['id'];
        header("Location: /");
    } else {
        $message = 'Sorry, those credentials do not match';
    }
endif;

After searching, I found questions and answers similar to this one, but they all were related to WordPress, and I couldn’t find a solution for Pure PHP.

ib.
  • 27,830
  • 11
  • 80
  • 100
Marwan Khaled
  • 323
  • 1
  • 2
  • 8
  • 2
    I guess $results is not an array? Try checking it with bool is_array ( mixed $var ) before checking other stuff. – Dominik Jul 30 '18 at 13:16
  • 2
    Dump `$results`. – Script47 Jul 30 '18 at 13:16
  • 4
    "**Pure PHP**" [count() will now yield a warning on invalid countable types passed to the array_or_countable parameter.](http://php.net/manual/en/function.count.php#refsect1-function.count-changelog) – MonkeyZeus Jul 30 '18 at 13:16
  • I think the problem with "$results". can you update your question like, how you get data into $results variable? – Rajinder Jul 30 '18 at 13:17
  • Alright, I updated the question and added the full code. – Marwan Khaled Jul 30 '18 at 13:19
  • 4
    Dump `$results`: `var_dump($results)`. It will probably be returning a bool (false) as the query might have failed. – Script47 Jul 30 '18 at 13:19
  • check this thread https://stackoverflow.com/a/54806221/3016038 for php is_countable function – Vipul Feb 21 '19 at 11:46
  • here is quick fix https://sdtuts.com/warning-count-parameter-must-be-an-array-or-an-object-that-implements-fixed/ even parameter not `array` – user3151197 Mar 17 '19 at 09:35

1 Answers1

26

PDO fetch returns false on failure. So you need to check this case too:

if ($results && count($results) > 0 && password_verify($_POST['password'], $results['password'])) {
    $_SESSION['user_id'] = $results['id'];
    header("Location: /");
} else {
    $message = 'Sorry, those credentials do not match';
}
Olim Saidov
  • 2,796
  • 1
  • 25
  • 32