0

this is my first simple login form using php sql. i have error. please read and find solution for my pbm. thanks in advance

<?php
    include('../includes/connect.php');
    if(isset($_POST['login_btn'])){
        $user_mobile=$_POST['user_mobile'];
        $user_password=$_POST['form_userpass'];

        $select_query="SELECT * FROM `user_info` WHERE 'user_mobile'='$user_mobile'";
        $result=mysqli_query($con,$select_query);
        $row_count=mysqli_num_rows($result);
        $row_data=mysqli_fetch_assoc($result);
        if($row_count==1){
            if(password_verify($user_password,$row_data['user_password'])){
                echo "<script>alert('Loggedin Successful')</script>";   
            }else{
                echo "<script>alert('Password mismatched')</script>";
            }
        }else{
            echo "<script>alert('You dont have an account')</script>";
        }
    }

?>

database i have stored datas below

1   user_name   user_email  user_mobile user_image  user_password   
1   saravanan   sara@gmail.com  1234567890  banana 1.jpg    sara

whenever i entered correct mobile no and password i recevied "you dont have an account" alert only. i can't login successfully

i need solution for above issue

brombeer
  • 8,716
  • 5
  • 21
  • 27
Saravanan Kumar
  • 1
  • 1
    *'user_mobile'='$user_mobile'* is comparing the entered mobile with the literal `user_mobile`. – Nigel Ren Nov 23 '22 at 09:27
  • **Warning:** Your code is vulnerable to SQL Injection attacks. You should use parameterised queries and prepared statements to help prevent attackers from compromising your database by using malicious input values. http://bobby-tables.com gives an explanation of the risks, as well as some examples of how to write your queries safely using PHP / mysqli. **Never** insert unsanitised data directly into your SQL. The way your code is written now, someone could easily steal, incorrectly change, or even delete your data. – ADyson Nov 23 '22 at 09:32
  • https://phpdelusions.net/mysqli also contains good examples of writing safe SQL using mysqli. See also the [mysqli documentation](https://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php) and this: [How can I prevent SQL injection in PHP?](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) . Parameterising your queries will also greatly reduce the risk of accidental syntax errors as a result of un-escaped or incorrectly quoted input values. If you learnt your current technique from a tutorial or book, please don't use it again. – ADyson Nov 23 '22 at 09:32

0 Answers0