php connection to database via login page

Question

I'm quite new to php so please forgive me for newb code, a lot more used to ASP.net though I'm required to use php, currently I have php page connecting to the database if successful stores the values into a cookie though throws these errors message due to incorrect string

Warning: Illegal string offset 'Member_Username' in C:\xampp\htdocs\awm\includes\login.php on line 10

Warning: Illegal string offset 'Member_Password' in C:\xampp\htdocs\awm\includes\login.php on line 10

Notice: Trying to get property of non-object in C:\xampp\htdocs\awm\includes\login.php on line 13

Here is my code:

<?php

try
{
    $Username = $_POST['Username'];
    $Password = $_POST['Password'];

    $con = mysqli_connect('localhost','root','Password','Letting');

    $query = "SELECT Member_Id, Member_Firstname, Member_Surname FROM Members WHERE Member_Username = '" . $Username['Member_Username'] .  "' AND Password = '" . $Password['Member_Password']. "'";
    $result = $con->query($query);

    if($result->num_rows)
    {
        $row = $result->fetch_assoc();

        $_SESSION['MemberId']=$row['Member_Id'];
        $_SESSION['Firstname']=$row['Member_Firstname'];
        $_SESSION['Surname']=$row['Member_Surname'];

        if(isset($_POST['RememberMe']))
        {
            setcookie('login',$row['Member_Id'],time() +60*60*60*24*7);
        }
        else
        {
            $msg = 'Login failed';
        }       
    }
}
catch(Exception $e)
{
    echo $e->errorMessage();
}   
?>

[You need to prevent SQL Injection.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Learn about [prepared statements](http://en.wikipedia.org/wiki/Prepared_statement) instead. — Jay Blanchard, Apr 16 '15 at 14:50

Kevin · Accepted Answer · 2015-04-16T14:39:55.920

5

Assuming these variables are strings:

$Username = $_POST['Username'];
$Password = $_POST['Password'];

Calling/treating them as arrays with using indices will surely fire that Illegal string offset error. Which is this line:

$query = "SELECT Member_Id, Member_Firstname, Member_Surname FROM Members WHERE Member_Username = '" . $Username['Member_Username'] .  "' AND Password = '" . $Password['Member_Password']. "'";

And as MySQLi already supports prepared statements, why not utilize them instead, because as of right now, you are vulnerable to SQL injection. I wouldn't add the solution which directly concatenates $Username and $Password but I'll give rough example on prepared statements instead:

$query = 'SELECT Member_Id, Member_Firstname, Member_Surname 
        FROM Members 
        WHERE Member_Username = ? 
        AND Password = ?';

$select = $con->prepare($query);
$select->bind_param('ss', $Username, $Password);
$select->execute();

if($select->num_rows > 0) {
    // rest of codes
}

Sidenote: It seems you're saving plain naked passwords, if its available to you (PHP 5.5 or greater), I'd suggest you should use password_hash + password_verify to handle your login module for hashing those passwords. If you have PHP 5.4 or lower and can't use the built-in, there's already a compatibility pack library for that.

edited Apr 16 '15 at 14:39

answered Apr 16 '15 at 14:30

Kevin

41,694
12
53
70

1

Info on prepared statements can be found here: http://php.net/manual/en/mysqli.quickstart.prepared-statements.php At the least, you should be using mysqli_escape_string() to avoid injection, @10gez10. – Chris Brendel Apr 16 '15 at 14:31
I was aware there was SQL injection though as previously mentioned I'm new to php, I haven't used parameters before in php hence the code though thank you for link to the page – 10AlexD10 Apr 16 '15 at 14:34
Although I've answered this, still confused why your binding both and username in one parameter? – 10AlexD10 Apr 16 '15 at 14:50
@10gez10 what do you mean _one parameter_? those `?` question marks? only question mark placeholders are available on mysqli, PDO has both question mark and named placeholders – Kevin Apr 16 '15 at 15:03
$select->bind_param('ss', $Username, $Password); this line code can not use two bind_params or just ('username','password',$Username,$Password);, you've been massive help btw thanks – 10AlexD10 Apr 16 '15 at 15:08

score 0 · Answer 2 · answered Apr 16 '15 at 14:31

0

Try this

$query = "SELECT Member_Id, Member_Firstname, Member_Surname  
FROM Members WHERE Member_Username = '" . $Username .  
"' AND Password = '" . $Password. "'";

answered Apr 16 '15 at 14:31

Rohit Gupta

4,022
20
31
41

php connection to database via login page

2 Answers2