0

I am building a login mask for a website. And I ran into a strange problem which I don't understand. I have a table with one entry (admin) and I am trying to validate the input from a login form. I tested everything and the problem seems to occur in my validate function. my table:

enter image description here

My validate function:

function validateAnmeldung($usermail, $password){
    $conn = connectDB();

    $sql = "SELECT id FROM anmeldung WHERE email = ?";
    $stmt = $conn->prepare($sql);
    $stmt->bind_param("s", $usermail);
    $stmt->execute();
    $userID = $stmt->get_result();

    if(empty($userID)){
        return false;
    }

    $sql2 = "SELECT passwort FROM anmeldung WHERE id = ?";
    $stmt2 = $conn->prepare($sql2);
    $stmt2->bind_param("i", $userID);
    $stmt2->execute();
    $actualPassword = $stmt2->get_result();

    if($password == $actualPassword){
        return true;
    }
    else{
        return false;
    }
}

Here some information: the parameter $usermail and $password are correct. The $userID which I am getting from my DB is correct. It just seems like the password which I am getting from my DB is incorrect. BUT if I execute the sql statement in the console, I get the right password. I copied this password and wrote the following line:

    if($actualPassword == '4735ef749cdac8ff5f8b182e9c479d780ef0dca7') return true;

and it returned false. Any ideas? kind regards

Jason Aller
  • 3,541
  • 28
  • 38
  • 38
Nomed
  • 11
  • 4
  • Hint: read what `get_result` returns. This will tell you that `$actualPassword` is __not a string__. – u_mulder Dec 23 '21 at 11:10
  • 1
    This isn't PDO, it seems to be mysqli, and the tutorial where you read about the usage was totally wrong. Check any [example in the official manual](https://www.php.net/manual/en/mysqli-stmt.get-result.php#refsect1-mysqli-stmt.get-result-examples). Also, you can get 2 columns in the same query, you don't need 2 queries. And are you sure you have plain text passwords? – Álvaro González Dec 23 '21 at 11:12
  • Okay thank you, guess I am going to read the manual – Nomed Dec 23 '21 at 11:16
  • NEVER store plaintext passwords in the database. https://stackoverflow.com/questions/30279321/how-to-use-phps-password-hash-to-hash-and-verify-passwords – miken32 Dec 23 '21 at 18:05

0 Answers0