Php login form error of row

Question

<?php
session_start();
include_once ('connection.php');

if (isset($_POST['login'])){
    $uemail = $_POST['email'];
    $upassword = $_POST['password'];
 }

    $query = "SELECT * FROM users WHERE email = $uemail and password = $upassword";
    $result = mysqli_query($connection, $query);  


    if(mysql_num_rows($query) == 1){
        $_SESSION['email'] = $email;
        header('Location: newfeeds.php');
        exit();

      }else{
        while ($row = mysql_fetch_assoc($result)) {
        echo $row["email"];
        echo $row["password"];
        }
    }
    ?>

I have php manual it says stop using sql and replaced sqli but that didn't work. It throwing an errors.

Connected Successfully Fatal error: Call to undefined function mysql_num_rows() in D:\XAMPP\htdocs\codeinventor\login.php on line 14

Change to mysqli_num_rows(). Your query is not safe or secure. Look into prepared statements — Jack, Mar 15 '16 at 17:06
Also see http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php?rq=1 — MECU, Mar 15 '16 at 17:11
[Your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — Jay Blanchard, Mar 15 '16 at 17:28
Please [stop using `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php). [These extensions](http://php.net/manual/en/migration70.removed-exts-sapis.php) have been removed in PHP 7. Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [PDO](http://php.net/manual/en/pdo.prepared-statements.php) and [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and consider using PDO, [it's really pretty easy](http://jayblanchard.net/demystifying_php_pdo.html). — Jay Blanchard, Mar 15 '16 at 17:28
Please use PHP's [built-in functions](http://jayblanchard.net/proper_password_hashing_with_PHP.html) to handle password security. If you're using a PHP version less than 5.5 you can use the `password_hash()` [compatibility pack](https://github.com/ircmaxell/password_compat). — Jay Blanchard, Mar 15 '16 at 17:28
You're mixing `mysql_*` and `mysqli_*` functions, which doesn't work. — Jay Blanchard, Mar 15 '16 at 17:29

score 1 · Answer 1 · answered Mar 15 '16 at 17:06

1

Change all the mysql_* functions to mysqli_* functions.

answered Mar 15 '16 at 17:06

MECU

770
1
11
25

score 0 · Answer 2 · answered Mar 15 '16 at 17:13

0

You can't use mysql and mysqli together. They are separate APIs and the resources they create are incompatible with one another. So Replace mysql_* with mysqli_* will help!

answered Mar 15 '16 at 17:13

Shashank Shah

2,077
4
22
46

score 0 · Answer 3 · answered Mar 15 '16 at 17:25

I agree with all here that you should change all the mysql_* functions to mysqli_* functions.

To your code with mysql API. Please use the following code:

<?php
session_start();
include_once ('connection.php');

if ($_SERVER['REQUEST_METHOD'] === 'POST') {

   if ($_POST['email'] != "" AND $_POST['password'] != ""){

      $uemail = $_POST['email'];
      $upassword = $_POST['password'];

      $query = "SELECT * FROM users WHERE email = '$uemail' and password = '$upassword'";

      $result = mysqli_query($connection, $query);

      if(mysql_num_rows($query) == 1){

        $_SESSION['email'] = $email;
        header('Location: newfeeds.php');
        exit();

      }else{

         while ($row = mysql_fetch_assoc($result)) {

           echo $row["email"];
          echo $row["password"];

        } 
      }
   }else{

     echo "mail or password is not valid";
   }

}else{

 echo "The form has been not submitted";

}


    ?>

If one user has entered the following string as username:

' or uid like '%admin%

Your query will be like this:

  $query = "SELECT * FROM users WHERE email = '' or uid like '%admin%' and password = '$upassword'";

That's why we told you you have to change all the mysql_* functions to mysqli_* functions.

Php login form error of row

3 Answers3