0

am working with login form but it doesn't work, when am trying to var_dump my sql

<?php
session_start();
include ('database.php');
if (isset($_POST['login'])) {
    $user = $_POST['username'];
    $pass = sha1($_POST['pass']);
    $sql = "SELECT * FROM users WHERE pass = sha1('$pass') 
                              AND username = '$user'";
    $query = mysqli_query($conn,$sql);
    $results = mysqli_num_rows($query);
    //die(var_dump($results));
    if ($results == 1) {
        $_SESSION['username']=$user;
    }
    header('location: index.php');
}
?>
RiggsFolly
  • 93,638
  • 21
  • 103
  • 149
Galus
  • 19
  • 4
  • 1
    Please dont __roll your own__ password hashing. PHP provides [`password_hash()`](http://php.net/manual/en/function.password-hash.php) and [`password_verify()`](http://php.net/manual/en/function.password-verify.php) please use them. And here are some [good ideas about passwords](https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet) If you are using a PHP version prior to 5.5 [there is a compatibility pack available here](https://github.com/ircmaxell/password_compat) – RiggsFolly Mar 06 '18 at 23:32
  • for one thing, you're sha'ing that password, twice. – Funk Forty Niner Mar 06 '18 at 23:32
  • _Note:_ It looks like you are `sha1`ing the password twice. Could that be your problem – RiggsFolly Mar 06 '18 at 23:32
  • Also don't ever concatenate your SQL, use parameterized queries. – Kaylined Mar 06 '18 at 23:35
  • looks like this is going to call for one heckuva big magic rabbit @RiggsFolly but the magician's out of town now, since the Carnival's over, *boohoo!* – Funk Forty Niner Mar 06 '18 at 23:36
  • @FunkFortyNiner I am sure thats a song reference, but I just cannot lock onto it – RiggsFolly Mar 06 '18 at 23:37
  • Your script is wide open to [SQL Injection Attack](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Even [if you are escaping inputs, its not safe!](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) Use [prepared parameterized statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) – RiggsFolly Mar 06 '18 at 23:37
  • Oh, you mean [this one](https://www.youtube.com/watch?v=pnJM_jC7j_4) @RiggsFolly about that "white" one, right? – Funk Forty Niner Mar 06 '18 at 23:38
  • What error do you specifically get? – Ice76 Mar 06 '18 at 23:39

0 Answers0