Script not getting values from the database

Question

i have this user sign in script using php prepared statement, but it is not working i have tried to switch values but still not working sometimes i get a "user does not exit" error sometimes just a blank page with the redirected link.


if(isset($_POST['login'])){

    require 'dbh.php';

    $mail = $_POST['email'];
    $pwd = $_POST['password'];

    if (empty($mail) || empty($pwd)) {
        header("Location: ../login.php?error=empty");
        exit();
    } else {
        $sql = "SELECT * FROM users WHERE id=? OR email=?;";
        $stmt = mysqli_stmt_init($db);
        if (!mysqli_stmt_prepare($stmt, $sql)) {
            header("Location: ../login.php?error=error");
            exit();
        } else {
           mysqli_stmt_bind_param($stmt, "ss", $mail, $pwd);
           mysqli_stmt_execute($stmt);
           $result = mysqli_stmt_get_result($stmt);

           if ($row = mysqli_fetch_assoc($result)){
                $pwdCheck = password_verify($pwd, $row['password']);
                if($pwdCheck == false) {
                    header("Location: ../login.php?error=wrongPassword");
                    exit();
                } else if ($pwdCheck == true) {
                   session_start();
                   $_SESSION['uId'] = $row['id'];
                   $_SESSION['username'] = $row['username'];

                    header("Location: ../profile/index.php?success");
                    exit();
                }
           }
        }
    }

} else {
    header("Location: ../login.php");
    exit();
} ```

should be `mysqli_stmt_bind_param($stmt, "ss", $mail, $mail);` — Your Common Sense, Apr 15 '20 at 09:41
@YourCommonSense thanks its now responding but now a wrong password error — Godfrey Kangwa, Apr 15 '20 at 09:55

score -1 · Answer 1 · answered Apr 15 '20 at 09:55

I can see many mistakes in your code.

seems like you have missed entering the id param in the query. Here you have mentioned id & email, "SELECT * FROM users WHERE id=? OR email=?;"

But here (mysqli_stmt_bind_param($stmt, "ss", $mail, $pwd);) you are binding $mail and password and not id and email.

You have used a extra semi colon ($sql = "SELECT * FROM users WHERE id=? OR email=?;";)

Script not getting values from the database

1 Answers1