PHP MySQL newbie, trouble with authentication on live server

Question

Using xampp for local development, I was able to build a very simple authentication for accessing a webpage. Everything worked fine on my local machine but I ran into some issues while testing it on my live server.

Instead of creating the database in phpMyAdmin, I had to use the MySQL Databases tool in my cPanel. No big deal, I guess, just create the myLogin database, then go into phpMyAdmin to add the myUsers table with ID, username, and password, and finally insert the user 'admin' with a hashed password.

Issue 1: I guess it only makes sense, but the following resulted in an error:

$DATABASE_HOST = 'localhost';
$DATABASE_USER = 'root';
$DATABASE_PASS = '';
$DATABASE_NAME = 'myLogin';

Failed to connect to MySQL: Access denied for user 'root'@'localhost' (using password: NO)

So, I opened mySQL Database again and added a user with a password and attached it to the myLogin database. I edited the code in the auth.php file to reflect the changes and... no error! However, no nothing.

Issue 2: After I enter the password and hit enter the browser just goes to the auth.php file and does nothing. No echoes, no redirect upon success, nothing. Below is the entire auth.php file:

<?php
session_start();
$DATABASE_HOST = 'localhost';
$DATABASE_USER = 'myUser';
$DATABASE_PASS = 'myPass';
$DATABASE_NAME = 'myLogin';

$con = mysqli_connect($DATABASE_HOST, $DATABASE_USER, $DATABASE_PASS, $DATABASE_NAME);
if ( mysqli_connect_errno() ) {
    die ('Failed to connect to MySQL: ' . mysqli_connect_error());
}
if ( !isset($_POST['uName'], $_POST['pWord']) ) {
    die ('Please fill both the username and password field!');
}
if ($stmt = $con->prepare('SELECT id, password FROM myUsers WHERE username = ?')) {
    $stmt->bind_param('s', $_POST['uName']);
    $stmt->execute();
    $stmt->store_result();

    if ($stmt->num_rows > 0) {
        $stmt->bind_result($id, $password);
        $stmt->fetch();
        if (password_verify($_POST['pWord'], $password)) {
            session_regenerate_id();
            $_SESSION['loggedin'] = TRUE;
            $_SESSION['name'] = $_POST['uName'];
            $_SESSION['id'] = $id;
            header('Location: ../wica.php');
        } else {
            echo 'Incorrect password!';
        }
    } else {
        echo 'Incorrect username!';
    }

    $stmt->close();
    }
?>

As I mentioned, I am a complete PHP newbie, this has all been cobbled together thanks to various tutorials. I don't know why it won't even echo "Incorrect password!" when I type the wrong password. It just sits on auth.php and does nothing and I'm clueless. This is my first time using mySQL on the remote server. Could there be critical settings that aren't the same as my xampp setup? Did I miss an important step somewhere?

Also, it seems a little insecure to have the DATABASE_USER and DATABASE_PASS just sitting in the auth.php file for anyone to see. Was I not supposed to do this? What are the secure alternatives, or are there any?

Answer 1

In case you got caught in the wheels of the comment-train, here's the answer:

My local dev. server (xampp) is running PHP 7+ while my remote server's PHP version was 5.4x, preventing password_verify from working. I was able to update the remote server's PHP version and everything worked. (Thank you fyrye!)

As was pointed out, the php code itself was a mess, so I found a better tutorial, I hope, and re-wrote the auth file:

<?php
if ( isset($_POST['pWord'])) {
    require '../../../dbh.inc.php';

    $username = $_POST['uName'];
    $userpass = $_POST['pWord'];

    if(empty($username) || empty($userpass)) {
        header("Location: ../index.html?error=emptyFields");
        exit();
    } 
    else {
        $sql = "SELECT * FROM users WHERE username=?";
        $stmt = mysqli_stmt_init($conn);
        if(!mysqli_stmt_prepare($stmt, $sql)) {
            header("Location: ../index.html?error=sqlerror");
            exit();
        } 
        else {
            mysqli_stmt_bind_param($stmt, "s", $username);
            mysqli_stmt_execute($stmt);
            $result = mysqli_stmt_get_result($stmt);
            if($row = mysqli_fetch_assoc($result)) {
                $pwdCheck = password_verify($userpass, $row['password']);
                if($pwdCheck == false) {
                    header("Location: ../index.html?error=wrongPass");
                    exit();
                } 
                else if($pwdCheck == true) {
                    session_start();
                    $_SESSION['loggedin'] = TRUE;

                    header("Location: ../wica.php");
                    exit();
                } 
                else {
                    header("Location: ../index.html?error=wrongPass");
                    exit();
                }
            } 
            else {
                header("Location: ../index.html?error=noUser");
                exit();
            }
        }
    }
} 
else {
    header("Location: ../index.html?error=justWrong");
    exit();
}
?>

You might notice that I also moved the database credentials to an include that now resides above the public root.

Is it the best solution? Probably not, but learning how to implement something like DotEnv is beyond me atm. I don't actually know PHP, I just use it sometimes like a pleb. Plus, I just spent a month translating 3000+ lines of Actionscript into javascript and creating html/css equivalents for all the .swf library elements. My brain is currently oatmeal. Hope my follies can at least help someone else.