I am having some MySQL issues and am super confused since this doesn't seem possible. Anyway, when I try to login, when I input the correct password I am sent to the screen that says that the username/password is incorrect.
Basically, my database looks like this:
USERNAME PASSWORD EMAIL
Xp10d3 Password12345 xp10d3@gmail.com
IiBlurBeriI Password33333 iiblurberii@gmail.com
I want to check if the user inputted their username and if the password matches, but I'm confused on how to do that. I got some help making the code, but it doesn't seem to work since any username can be inputted BEFORE it's verified (it's verified in the user's email) and once they inputted it the password doesn't have to match. Ex. WHAT I WANT: User inputs the username Xp10d3. User inputs the password Password1111. There is an error message saying the password doesn't match. User then inputs the password Password12345. It is valid and sets the $_SESSION variable to their username. WHAT IS HAPPENING NOW: User inputs Xp10d3 which is in the database. The password they input is Password12345 which is correct and they get sent to the screen that says that their password is incorrect.
I did some testing and logged all the variables. It all boiled down to the fact that $row["PASSWORD"] was incorrect. How do I fix this?
Some important notes:
The variable $_SESSION['password_not'] is not a hashed password. However, all the other variables that I get except for that variable and the $password variable are hashed.
List of variables that are NOT hashed:
$_SESSION['password_not']
$password
Variables that ARE hashed:
$row["PASSWORD"]
Any passwords in the database
Code: login_check_update.php:
<!DOCTYPE HTML>
<html>
<head>
<style>
body {
text-align: center;
font-family: sans-serif;
}
a {
text-decoration: none;
color: blue;
}
#logout {
margin: 0 auto;
text-align: center;
border: 1px solid;
border-radius: 5px;
max-width:1024px;;
height: 800px;
}
</style>
</head>
<body>
<div id="logout">
<?php
session_start();
/* Sends an email to the user and adds the special key to another database */
$username = $_GET['username']; /* Gets the username that was submitted in the HTML form. */
$password = $_GET['password']; /* Gets the password that was submitted in the HTML form. */
$servername = "localhost"; /* MySQL database. Change if needed! Most of the time its not localhost unless you're hosting on your computer. */
$user = 'xxx'; /* MySQL username. Change if needed. */
$pass = 'xxx'; /* MySQL password. Change if needed. */
$dbname = 'vibemcform'; /* MySQL database name. Change if needed. */
$bytes = random_bytes(10); /* Randomized code */
$key = bin2hex($bytes); /* Makes the randomized code */
$_SESSION['username'] = $username;
$_SESSION['password'] = $password;
$link = "live.php";
$con = new mysqli($servername, $user, $pass, $dbname); /* Connects to the database */
$query = "SELECT USERNAME FROM data WHERE USERNAME = '".$username."'";
$result = $con->query($query);
$row = $result->fetch_assoc();
$selectTwo = "SELECT PASSWORD FROM data WHERE PASSWORD = '".$password."'";
$result2 = $con->query($selectTwo);
$row2 = $result->fetch_assoc();
/* Delete after */
$test = $row["USERNAME"];
$testTwo = password_verify($_SESSION['password_not'], $row["PASSWORD"]);
if ($username == $row["USERNAME"] && password_verify($_SESSION['password_not'], $row["PASSWORD"])) {
echo "Found data in the database! Visit the chat!";
echo "<form action='live.php' method='post'><a href='".$link."'><input type='submit' name='btn1' value='$username'/></a></form>";
echo "Session ID: ". session_id() . ". ";
} else {
echo "Username not found/password incorrect. Please try again!";
}
$conn = null;
exit;
?>
<a href="index.html">Home</a>
</div>
</body>
</html>
