I am trying to build some functions that help me with my project in PHP. After submitting the form the attempt column value in the database is not increasing, and there are no errors after submitting. The SQL connection is working without any problems. I think the problem is with the function itself.
<?php
include 'config/config.php';
include './framework/escaper/Escaper.php';
use Framework\Escaper\Escaper;
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if(isset($name,$surname)){
$instance = new Escaper();
$stmt = $instance->CrackAttempt([
'usersTable'=>'moemen',
'mailColumn'=>'name',
'passColumn'=>'surname',
'emailField'=>$_POST['name'],
'passField'=>$_POST['surname']
]);
}
}
?>
<form action="" method="POST">
<input type="text" name="name">
<input type="text" name="surname">
<button type="submit">submit</button>
</form>
<?php
namespace Framework\Escaper;
use PDO;
use PDOException;
// Calculate the root directory path dynamically
$rootDir = __DIR__ . '/../../'; // Go back two steps from the current directory
include $rootDir . 'config/config.php';
class Escaper
{
// Function to execute SQL queries safely using prepared statements
public function antiInjection($query, $params = [])
{
global $dbConfig;
try {
$pdo = new PDO("mysql:host={$dbConfig['host']};dbname={$dbConfig['dbname']}", $dbConfig['username'], $dbConfig['password']);
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$stmt = $pdo->prepare($query);
foreach ($params as $paramName => $paramValue) {
$stmt->bindValue($paramName, $paramValue);
}
$stmt->execute();
return $stmt;
} catch (PDOException $e) {
echo "Error: " . $e->getMessage();
return null;
} finally {
unset($pdo);
}
}
// Notice before using this u must create LoginAttempt column + the default must be equal to 0 to
public function CrackAttempt(array $params)
{
// Extract values from the $params array using array destructuring
[
'usersTable' => $usersTable,
'mailColumn' => $mailColumn,
'passColumn' => $passColumn,
'emailField' => $emailField,
'passField' => $passField,
] = $params;
$query = "SELECT * FROM $usersTable WHERE $mailColumn = :email AND $passColumn = :password";
// Prepare the parameters for the statement
$preparedParams = [
':email' => $emailField,
':password' => $passField,
];
$this->antiInjection($query, $preparedParams); // Capture the returned statement object
$userLoginAttemptQuery = "UPDATE $usersTable SET LoginAttempt = LoginAttempt + 1 WHERE $mailColumn = :email";
// Prepare the parameters for the statement
$preparedParams2 = [
':email' => $emailField,
];
$this->antiInjection($userLoginAttemptQuery, $preparedParams2); // Capture the returned statement object
}
}