1

I want login/ to be successful This is my connect File for starting session

<?php
$connect_error='Error...'
session_start();

    $con=mysql_connect('localhost','root','')or die(connect_error); 
    mysql_select_db('lothlorien',$con) or die(connect_error);
    $errors=array();
    require 'Functions/users.php';
    require 'Login/L1.php';
    require 'Functions/General.php';

This is My Login Widget File

    <!DOCTYPE html>
    <html lang="en">

        <head>

            <meta charset="utf-8">
            <meta http-equiv="X-UA-Compatible" content="IE=edge">
            <meta name="viewport" content="width=device-width, initial-scale=1">
            <title>Lothlorien</title>

            <!-- CSS -->
            <link rel="stylesheet" href="http://fonts.googleapis.com/css?family=Roboto:400,100,300,500">
            <link rel="stylesheet" href="assets/bootstrap/css/bootstrap.min.css">
            <link rel="stylesheet" href="assets/font-awesome/css/font-awesome.min.css">
            <link rel="stylesheet" href="assets/css/form-elements.css">
            <link rel="stylesheet" href="assets/css/style.css">
            <style>
            .row{
               margin:auto;
               width:700px;
            }
            </style>
        </head>


        <body>
        <?php 
        include  'Core/Database/connect.php';
         ?>
        <div class="top-content">

                    <div class="inner-bg">
                        <div class="container">

                            <div class="row">
                                <div class="col-sm-8 col-sm-offset-2 text">
                                    <h1>Lothlorien Login Form</h1>
                                    </div>
                                </div>
                            </div>
                        <div class="content">
                            <div class="row">

                                    <div class="form-box">
                                        <div class="form-top">
                                            <div class="form-top-left">
                                                <h3>Login to our site</h3>


                                       <p>Enter username and password to log in:</p>
                                    </div>
                                    <div class="form-top-right">
                                        <i class="fa fa-lock"></i>
                                    </div>
                                </div>
                                <div class="form-bottom">
                                    <form role="form" action="" method="post" class="login-form">
                                        <div class="form-group">
                                            <label class="sr-only" for="form-username">Username</label>
                                            <input type="text" name="form-username" placeholder="Username..." class="form-username form-control" id="form-username">
                                        </div>
                                        <div class="form-group">
                                            <label class="sr-only" for="form-password">Password</label>
                                            <input type="password" name="form-password" placeholder="Password..." class="form-password form-control" id="form-password">
                                        </div>
                                        <button type="submit" class="btn">Sign in!</button>
                                    </form>
                                </div>
                            </div>

                    </div>
                </div>
                </div>
            </div>
        <script src="assets/js/jquery-1.11.1.min.js"></script>
        <script src="assets/bootstrap/js/bootstrap.min.js"></script>
        <script src="assets/js/jquery.backstretch.min.js"></script>
        <script src="assets/js/scripts.js"></script>

        <!--[if lt IE 10]>
            <script src="assets/js/placeholder.js"></script>
        <![endif]-->

    </body>

</html>

        ?>

this is my Login for login validation

<?php
include 'Core/Database/connect.php';
include 'Core/Functions/Users.php';
if(empty($_POST)===false)
{
    $form_username = $_POST['form-username'];
    $form_password = $_POST['form-password'];

}
if(user_exists($form_username)===false)
{
    $errors[]="Register before Logging in";
}
else if(user_active($form_username)===false)
{
    $errors[]="Not activated Your account";
}

This is where i want the validation to happen

  else
    {
        $login=login($form_username,$form_password);
        if($login=== false)
        {
            $errors[]="Wrong Username and password combination";

        }

This is where the redirection takes place

else 
        {
            $_SESSION['user_id']=$login;
            header('Location:index.php');
            exit();
        }
    }

    print_r($errors);
    ?>

And finally these are my functions...

<?php
    function user_exists($form_username)
    {
        $form_username=sanitize($form_username);
        $query=mysql_query("SELECT COUNT('User_id') FROM 'user' WHERE 'Username'='$form_username'");
        return (mysql_result($query,0) == 1) ? true :false;
    }
    function user_active($form_username)
    {
        $form_username=sanitize($form_username);
        $query=mysql_query("SELECT COUNT('User_id') FROM 'user' WHERE 'Username'='$form_username' AND 'active'= 1");
        return (mysql_result($query,0) == 1) ? true :false;
    }
    function user_id_from_username($username)
    {
        $form_username=sanitize($username);
        $query=mysql_query("SELECT 'user_id' FROM 'user' WHERE 'Username'='$form_username' ");
        return (mysql_result($query,0,'user_id'));
    }
    function login($form_username,$form_password)
    {
        $user_id=user_id_from_username($form_username);

        $form_password=md5($form_password);
        $query=mysql_query("SELECT COUNT('User_id') FROM 'user' WHERE 'Username'='$form_username' AND 'Password'= '$form_password'");
        return (mysql_result($query)==1)? $user_id:false;

    }


?>

I don't know the root of my problem so I kinda posted all up Problems I encounter

  • 1)No error messages showing up..
  • 2)want to redirect to index.php after successful login
  • 3)Successful Message should be displayed once login is done

Database entries are correct.

Cœur
  • 37,241
  • 25
  • 195
  • 267
  • use mysqli not mysql – Rafael Shkembi Jan 05 '17 at 14:08
  • 4
    ***Please [stop using `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php).*** [These extensions](http://php.net/manual/en/migration70.removed-exts-sapis.php) have been removed in PHP 7. Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [PDO](http://php.net/manual/en/pdo.prepared-statements.php) and [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and consider using PDO, [it's really pretty easy](http://jayblanchard.net/demystifying_php_pdo.html). – Jay Blanchard Jan 05 '17 at 14:10
  • 3
    [Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)***. Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! – Jay Blanchard Jan 05 '17 at 14:10
  • 4
    Add error reporting to the top of your file(s) right after your opening ` – Jay Blanchard Jan 05 '17 at 14:11
  • 5
    **Never store plain text passwords!** Please use PHP's [built-in functions](http://jayblanchard.net/proper_password_hashing_with_PHP.html) to handle password security. If you're using a PHP version less than 5.5 you can use the `password_hash()` [compatibility pack](https://github.com/ircmaxell/password_compat). Make surey ou ***[don't escape passwords](http://stackoverflow.com/q/36628418/1011527)*** or use any other cleansing mechanism on them before hashing. Doing so *changes* the password and causes unnecessary additional coding. – Jay Blanchard Jan 05 '17 at 14:11
  • 3
    ***You really shouldn't use [MD5 password hashes](http://security.stackexchange.com/questions/19906/is-md5-considered-insecure)*** as these hashes are not secure *at all*. – Jay Blanchard Jan 05 '17 at 14:12
  • i tried using mysqli and still aint no luck... – Sharvil Turbadkar Jan 05 '17 at 14:19
  • i have no idea of Prepared statements – Sharvil Turbadkar Jan 05 '17 at 14:20
  • 1
    @JayBlanchard Looks like you are doing all the heavy lifting on this one sir – RiggsFolly Jan 05 '17 at 14:21
  • When it comes to this kind of stuff Jay is right (on all counts). Basically I would use a load of echo's or var_dumps and dies to work out the issues. FYI with PDO - take a look at fluentPDO. I found it really easy to use and get started with. – Richard Housham Jan 05 '17 at 15:14
  • Thank you@JayBlanchard Sir i am getting some breakthrough here... – Sharvil Turbadkar Jan 05 '17 at 15:31

0 Answers0