-1

I have two similar databases; both using username and password. Duplicate PHP code is used to sign up - but while the first database can log in, the second can't. I think I must be missing something obvious but have tried everything I can think of to try resolve this.

Database 1 - loginregister Table - 'users' Columns id fullname username password

Database 2 - raceroutelogin Table 'users' Columns user_id username email password

My Android app (tried using OkHTTP3 on both databases - I can log in to loginregister, but not raceroutelogin, with only a url change, therefore I dont think the issue is there) seems to be working. I can also sign up users to both databases.

My PHP code is also the same (except for the dbconfig database name)

    <?php
require "DataBaseConfig.php";

class DataBase
{
    public $connect;
    public $data;
    private $sql;
    protected $servername;
    protected $username;
    protected $password;
    protected $databasename;

    public function __construct()
    {
        $this->connect = null;
        $this->data = null;
        $this->sql = null;
        $dbc = new DataBaseConfig();
        $this->servername = $dbc->servername;
        $this->username = $dbc->username;
        $this->password = $dbc->password;
        $this->databasename = $dbc->databasename;
    }

    function dbConnect()
    {
        $this->connect = mysqli_connect($this->servername, $this->username, $this->password, $this->databasename);
        return $this->connect;
    }

    function prepareData($data)
    {
        return mysqli_real_escape_string($this->connect, stripslashes(htmlspecialchars($data)));
    }

    function logIn($table, $username, $password)
    {
        $username = $this->prepareData($username);
        $password = $this->prepareData($password);
        $this->sql = 
        "SELECT * from " . $table . " where username = '" . $username . "'";
        $result = mysqli_query($this->connect, $this->sql);
        $row = mysqli_fetch_assoc($result);
        if (mysqli_num_rows($result) != 0) {
            $dbusername = $row['username'];
            $dbpassword = $row['password'];
            if ($dbusername == $username && password_verify($password, $dbpassword)) {
                $login = true;
            } else $login = false;
        } else $login = false;

        return $login;
    }

    function signUp($table, $username, $email, $password)
    {
        $username = $this->prepareData($username);
        $email = $this->prepareData($email);
        $password = $this->prepareData($password);       
        $password = password_hash($password, PASSWORD_DEFAULT);
        $this->sql =
            "INSERT INTO " . $table . " (username, email, password) VALUES ('" . $username . "','" . $email . "','" . $password . "')";
        if (mysqli_query($this->connect, $this->sql)) {
            return true;
        } else return false;
    }

}

?>

My login.php

<?php
require "DataBase.php";
$db = new DataBase();
if (isset($_POST['username']) && isset($_POST['password'])) {
    if ($db->dbConnect()) {
        if ($db->logIn("users", $_POST['username'], $_POST['password'])) {
            echo "Login Success";
        } else echo "Login Fail";
    } else echo "Error: Database connection";
} else echo "All fields are required";
?>

Any help gratefully accepted, I have been looking at this for 3 days now.

fgadev
  • 21
  • 5
  • At first glance I don't see an issue. What have you tried? Do you use a debugger? If so, where does the login fail? If not, I would strongly suggest using one – Pepper Apr 19 '21 at 14:30
  • Thanks for taking the time to read the code. I haven't found a way to debug in php. i've called both & tried 2 different libraries in my Android app, (both working on the first db), so i dont think its the calling app. I tried building a form in HTML to submit but got confused, I'll try that & try printing out the mysql messages. Thanks again – fgadev Apr 19 '21 at 16:22
  • **Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/5741187) – Dharman Apr 19 '21 at 19:00
  • Thanks @Dharman, this is just for a college project, i've no intention of putting it out in the wild yet :) – fgadev Apr 19 '21 at 20:09

1 Answers1

0

Found the problem - in my non-working database I had password as a VARCHAR, length 40. I changed this to text and the login started working fine. Moral of the story, dont use VARCHAR for password storage.

fgadev
  • 21
  • 5