0

i've created php login with mysql database. when i login with correct username and wrong password it still sends me to the logged in page.

 <?php
include "appConfig/conn.php";
function antiinjection($data){
  $filter_sql = mysql_real_escape_string(stripslashes(strip_tags(htmlspecialchars($data,ENT_QUOTES))));
  return $filter_sql;
}

$username   = antiinjection($_POST['txtUsername']);
$pass       = antiinjection(md5($_POST['txtPassword']));


$waktu = time()+25200;
$expired=60;

$query=mysql_query("SELECT * FROM tmember WHERE usermember='$username' OR emailMember='$username' 
                 AND passmember='$pass' AND aktif='Y'");
$in=mysql_num_rows($query);
$r=mysql_fetch_array($query);

if ($in > 0){
  session_start();

  $_SESSION['kdMember']       = $r['kdMember'];
  $_SESSION['username']           = $r['usermember'];
  $_SESSION['email']         = $r['emailMember'];
  $_SESSION['password']           = $r['passmember'];
  $_SESSION['nmLengkap']          = $r['nmLengkap'];
  $_SESSION['foto']               = $r['fotoMember'];


  $_SESSION['timeout']      = $waktu+$expired;
  $waktulog= time();                                                

  header('location:frame.php?p=home');
}
else{
    echo "<script type='text/javascript'>
  window.alert('Username Atau Password Anda Salah'); 
  window.location =('index.php')</script>";
}
?>

please help me to fix this problem

Bagja Muhammad Rizaldi
  • 1
  • 1
    **WARNING**: Do not use the obsolete [`mysql_query`](http://php.net/manual/en/function.mysql-query.php) interface which was removed in PHP 7. A replacement like [PDO is not hard to learn](https://phpdelusions.net/pdo) and a guide like [PHP The Right Way](http://www.phptherightway.com/) helps explain best practices. Here parameters are **NOT** [properly escaped](http://bobby-tables.com/php) and this has severe [SQL injection bugs](http://bobby-tables.com/) in this code. Escape **any** and all user data, especially from `$_POST` or `$_GET`. – tadman Jun 30 '18 at 21:03
  • 1
    **WARNING**: Writing your own access control layer is not easy and there are many opportunities to get it severely wrong. Please, do not write your own authentication system when any modern [development framework](http://codegeekz.com/best-php-frameworks-for-developers/) like [Laravel](http://laravel.com/) comes with a robust [authentication system](https://laravel.com/docs/master/authentication) built-in. At the absolute least follow [recommended security best practices](http://www.phptherightway.com/#security) and **never store passwords as plain-text** or a weak hash like **SHA1 or MD5**. – tadman Jun 30 '18 at 21:03
  • 1
    I'm extremely concerned about this code. There's a significant number of things about this which make it too hazardous to deploy. Unless this is purely an academic exercise you should not proceed. If this is an academic exercise there's a lot of important things to learn here. – tadman Jun 30 '18 at 21:04
  • 1
    yeah i use this code only for my academic , thx for all of the suggestion and answer – Bagja Muhammad Rizaldi Jun 30 '18 at 21:09

0 Answers0