-2

Hello I seem to be having a very frustrating problem with my login which i cannot seem to fix as there is no error output.I seem to have fixed this problem on my mac but i transfered the exact files over to my windows pc and its stopped working again. whenever I try and login with the example a@a.com and password a is seems to just refresh the page over and over no matter how many times I have tried.I was wondering if anyone could help with this error? I have tried adding the action to login.php it seems to make no difference.

picture of table im taking data from:

session.php:

<?php
       include('config.php');
       session_start();

       $user_check = $_SESSION['login_user'];

       $ses_sql = mysqli_query($conn,"select email_adress from customer where email_adress = '$user_check' ");

       $row = mysqli_fetch_array($ses_sql,MYSQLI_ASSOC);

       $login_session = $row['email_adress'];

       if(!isset($_SESSION['login_user'])){
          header("location:login.php");
       }
    ?>

login.php

<?php
   include("config.php");
   session_start();

   if($_SERVER["REQUEST_METHOD"] == "POST") {
      // username and password sent from form 

      $myusername = mysqli_real_escape_string($conn,$_POST['username']);
      $mypassword = mysqli_real_escape_string($conn,$_POST['password']); 

      $sql = "SELECT customer_id FROM customer WHERE email_adress = '$myusername' and password = '$mypassword'";
      $result = mysqli_query($conn,$sql);
      $row = mysqli_fetch_array($result,MYSQLI_ASSOC);
      $active = $row['customer_id'];

      $count = mysqli_num_rows($result);

      // If result matched $myusername and $mypassword, table row must be 1 row

      if($count == 1) {

         $_SESSION['login_user'] = $myusername;

         header("location: index2.php");
      }else {
         $error = "Your Login Name or Password is invalid";
      }
   }
?>
<!DOCTYPE html>
<html lang="en">

<head>
    <title>Login | Bid4MyJob</title>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <meta name="description" content="Bid4MyJob">
    <meta name="author" content="James Wood">
    <!-- CSS -->
    <link href="assets/css/bootstrap.css" rel="stylesheet" type="text/css">
    <link href="assets/css/font-awesome.min.css" rel="stylesheet" type="text/css">
    <link href="assets/css/main.css" rel="stylesheet" type="text/css">
    <link href="assets/css/my-custom-styles.css" rel="stylesheet" type="text/css">

    <!-- IE 9 Fallback-->
    <!--[if IE 9]>
        <link href="assets/css/ie.css" rel="stylesheet">
    <![endif]-->
    <!-- GOOGLE FONTS -->
    <link href='http://fonts.googleapis.com/css?family=Open+Sans:300,400italic,400,600,700' rel='stylesheet' type='text/css'>
    <link href='http://fonts.googleapis.com/css?family=Roboto+Condensed:300,300italic,400italic,700,400,300' rel='stylesheet' type='text/css'>
    <!-- FAVICONS -->
    <link rel="apple-touch-icon-precomposed" sizes="144x144" href="assets/ico/repute144x144.png">
    <link rel="apple-touch-icon-precomposed" sizes="114x114" href="assets/ico/repute114x114.png">
    <link rel="apple-touch-icon-precomposed" sizes="72x72" href="assets/ico/repute72x72.png">
    <link rel="apple-touch-icon-precomposed" href="assets/ico/repute57x57.png">
    <link rel="shortcut icon" href="assets/ico/favicon.png">
</head>

<body>
    <!-- WRAPPER -->
    <div class="wrapper">
        <!-- NAVBAR -->
        <nav class="navbar navbar-default " role="navigation">
            <div class="container">
                <!-- TOPBAR -->
                <div class="topbar">
                    <ul class="list-inline top-nav">
                        <li>
                            <div class="btn-group">
                                <button type="button" class="btn btn-link dropdown-toggle btn-xs" data-toggle="dropdown"><img src="assets/img/flags/United-Kingdom.png" alt="United Kingdom"> United Kingdom <span class="caret"></span></button>
                                <ul class="dropdown-menu dropdown-menu-right country-selector" role="menu">
                                    <li>
                                        <a href="#"><img src="assets/img/flags/United-Kingdom.png" alt="United Kingdom"> United Kingdom</a>
                                    </li>
                                    <li>
                                        <a href="#"><img src="assets/img/flags/Japan.png" alt="Japan"> Japan</a>
                                    </li>
                                    <li>
                                        <a href="#"><img src="assets/img/flags/China.png" alt="China"> China</a>
                                    </li>
                                    <li>
                                        <a href="#"><img src="assets/img/flags/Germany.png" alt="Germany"> Germany</a>
                                    </li>
                                </ul>
                            </div>
                        </li>
                        <li><a href="#">Help</a></li>
                        <li><a href="#">Support</a></li>
                    </ul>
                    <div class="searchbox">
                        <form method="post">
                            <div class="input-group input-group-sm">
                                <input type="text" class="form-control" placeholder="search ...">
                                <span class="input-group-btn">
                                    <button class="btn btn-default" type="button"><i class="fa fa-search"></i></button>
                                </span>
                            </div>
                        </form>
                    </div>
                </div>
                <!-- END TOPBAR -->
                <div class="navbar-header">
                    <button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#main-nav">
                        <span class="sr-only">Toggle Navigation</span>
                        <i class="fa fa-bars"></i>
                    </button>
                    <a href="index.html" class="navbar-brand navbar-logo navbar-logo-bigger">

                    </a>
                </div>
                <!-- MAIN NAVIGATION -->
                <div id="main-nav" class="navbar-collapse collapse">
                    <ul class="nav navbar-nav navbar-right">
                        <li>
                            <a href="index.php">HOME</a>
                        </li>
                        <li>
                            <a href="HIW.php">HOW IT WORKS</a>
                        </li>
                        <li>
                            <a href="postjob.php">POST JOB</a>
                        </li>
                        <li>
                            <a href="findjob.php">FIND JOB</a>
                        </li>
                        <li>
                            <a href="signup.php">SIGN UP</a>
                        </li>
                        <li>
                            <a href="login.php">LOGIN</a>
                        </li>
                    </ul>
                </div>
                <!-- END MAIN NAVIGATION -->
            </div>
        </nav>
        <!-- END NAVBAR -->
        <!-- BREADCRUMBS -->
        <div class="page-header">
            <div class="container">
                <h1 class="page-title pull-left">Login</h1>
                <ol class="breadcrumb">
                    <li><a href="#">Home</a></li>
                    <li class="active">Login</li>
                </ol>
            </div>
        </div>
        <!-- END BREADCRUMBS -->
        <!-- PAGE CONTENT -->
        <div class="page-content">

                            <div class="col-md-6">
                                <!-- LOGIN FORM -->
                                <h2 class="section-heading">Login Form</h2>
                                <form class="form-horizontal" role="form" action = "login.php" method = "post">
                                    <div class="form-group">
                                        <label for="username" class="control-label sr-only">Email</label>
                                        <div class="col-sm-12">
                                            <div class="input-group">
                                                <input type="email" class="form-control" id="username" name = "username" placeholder="Email">
                                                <span class="input-group-addon"><i class="fa fa-envelope"></i></span>
                                            </div>
                                        </div>
                                    </div>
                                    <div class="form-group">
                                        <label for="password" class="control-label sr-only">Password</label>
                                        <div class="col-sm-12">
                                            <div class="input-group">
                                                <input type="password" class="form-control" id="password" name="password" placeholder="Password">
                                                <span class="input-group-addon"><i class="fa fa-lock"></i></span>
                                            </div>
                                        </div>
                                    </div>
                                    <div class="form-group">
                                        <div class="col-sm-12">
                                            <label class="fancy-checkbox">
                                                <input type="checkbox">
                                                <span>Remember me</span>
                                            </label>
                                        </div>
                                    </div>
                                    <div class="form-group">
                                        <div class="col-sm-12">
                                            <button type="submit" class="btn btn-primary"><i class="fa fa-sign-in"></i> Sign in</button>
                                        </div>
                                    </div>
                                </form>
                                <br>
                                <p><em>Don't have an account yet?</em> <a href="#"><strong>Sign Up</strong></a>
                                    <br>
                                    <em>Forgot your password?</em> <a href="#">Recover Password</a></p>
                                <!-- END LOGIN FORM -->
                            </div>
                        </div>
                        <br>
                        <br>
                        <div class="row">
                            <div class="col-md-6">
                                <!-- LOGIN FORM WITH LABEL -->

                                <!-- END LOGIN FORM WITH LABEL -->
                            </div>
                            <div class="col-md-6">
                                <!-- SIMPLE FORM -->

                                <!-- END SIMPLE FORM -->
                            </div>
                        </div>
                        <br>
                        <br>
                        <!-- INLINE FORM -->

                        <!-- END INLINE FORM -->
                    </div>
                </div>
            </div>
        </div>
        <!-- END PAGE CONTENT -->
        <!-- FOOTER -->
        <footer>
            <div class="container">
                <div class="row">
                    <div class="col-md-4">
                        <!-- COLUMN 1 -->
                        <h3 class="sr-only">ABOUT US</h3>
                        <img src="assets/img/logo/repute-logo-light.png" class="logo" alt="Repute">
                        <p>Proactively aggregate B2B initiatives before extensive channels. Monotonectally extend interactive methods of empowerment through excellent applications. Rapidiously synergize visionary products with sticky technology.</p>
                        <br>
                        <address class="margin-bottom-30px">
                            <ul class="list-unstyled">
                                <li>Unit 5, Block B Nesfield Road
                                    <br/> Colchester, Essex CO4 3ZL 222222</li>
                                <li>Phone: 01206 588 000</li>
                                <li>Email: sales@universalwebdesign.co.uk</li>
                            </ul>
                        </address>
                        <!-- END COLUMN 1 -->
                    </div>
                    <div class="col-md-4">
                        <!-- COLUMN 2 -->
                        <h3 class="footer-heading">USEFUL LINKS</h3>
                        <div class="row margin-bottom-30px">
                            <div class="col-xs-6">
                                <ul class="list-unstyled footer-nav">
                                    <li><a href="#">About Us</a></li>
                                    <li><a href="#">News</a></li>
                                    <li><a href="#">Community</a></li>
                                    <li><a href="#">Career</a></li>
                                    <li><a href="#">Blog</a></li>
                                </ul>
                            </div>
                            <div class="col-xs-6">
                                <ul class="list-unstyled footer-nav">
                                    <li><a href="#">Press Kit</a></li>
                                    <li><a href="#">FAQ</a></li>
                                    <li><a href="#">Terms</a></li>
                                    <li><a href="#">Privacy Policy</a></li>
                                    <li><a href="#">Contact Us</a></li>
                                </ul>
                            </div>
                        </div>
                        <!-- END COLUMN 2 -->
                    </div>
                    <div class="col-md-4">
                        <!-- COLUMN 3 -->
                        <div class="newsletter">
                            <h3 class="footer-heading">NEWSLETTER</h3>
                            <p>Get the latest update from us by subscribing to our newsletter.</p>
                            <form class="newsletter-form" method="POST">
                                <div class="input-group input-group-lg">
                                    <input type="email" class="form-control" name="email" placeholder="youremail@domain.com">
                                    <span class="input-group-btn"><button class="btn btn-primary" type="button"><i class="fa fa-spinner fa-spin"></i><span>SUBSCRIBE</span></button>
                                    </span>
                                </div>
                                <div class="alert"></div>
                            </form>
                        </div>
                        <div class="social-connect">
                            <h3 class="footer-heading">GET CONNECTED</h3>
                            <ul class="list-inline social-icons">
                                <li><a href="#" class="facebook-bg"><i class="fa fa-facebook"></i></a></li>
                                <li><a href="#" class="twitter-bg"><i class="fa fa-twitter"></i></a></li>
                                <li><a href="https://plus.google.com/115190620540200390059" class="googleplus-bg"><i class="fa fa-google-plus"></i></a></li>
                                <li><a href="#" class="rss-bg"><i class="fa fa-rss"></i></a></li>
                            </ul>
                        </div>
                        <!-- END COLUMN 3 -->
                    </div>
                </div>
            </div>
            <!-- COPYRIGHT -->
            <div class="text-center copyright">
                &copy;2018 Bid4MyJob. All Rights Reserved.
            </div>
            <!-- END COPYRIGHT -->
        </footer>
        <!-- END FOOTER -->
    </div>
    <!-- END WRAPPER -->
    <!-- JAVASCRIPTS -->
    <script src="assets/js/jquery-2.1.1.min.js"></script>
    <script src="assets/js/bootstrap.min.js"></script>
    <script src="assets/js/plugins/autohidingnavbar/jquery.bootstrap-autohidingnavbar.min.js"></script>
    <script src="assets/js/repute-scripts.js"></script>

</body>

</html>
mplungjan
  • 169,008
  • 28
  • 173
  • 236
  • 1
    Don't rely on the `real_escape_string()` functions to prevent SQL injection, [they alone are not sufficient](https://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string). You should use prepared statements with bound parameters, via either [**mysqli**](https://secure.php.net/manual/en/mysqli.prepare.php) or [**PDO**](https://secure.php.net/manual/en/pdo.prepared-statements.php). [**This post**](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) has some good examples. – Alex Howansky Mar 27 '18 at 14:23
  • 1
    *"no error"* - I don't see any error handling whatsoever. – Funk Forty Niner Mar 27 '18 at 14:23
  • 1
    **Never** store plain text passwords. Instead use [`password_hash()`](http://us3.php.net/manual/en/function.password-hash.php) and [`password_verify()`](http://us3.php.net/manual/en/function.password-verify.php). If you're using a version of PHP prior to 5.5, do **not** use MD5 or SHA1 to hash passwords. Instead you can use [this compatibility pack](https://github.com/ircmaxell/password_compat). – Alex Howansky Mar 27 '18 at 14:23
  • @AlexHowansky that link about `real_escape_string()` is mysql_, not mysqli_. That answer https://stackoverflow.com/a/23277864/ is just all over the place, IMHO. First it shows `mysql_set_charset() cannot help` being mysql_, then `mysqli::real_escape_string(), since that's just a different wrapper....`. I don't get that. – Funk Forty Niner Mar 27 '18 at 14:25
  • This is not the code review stack exchange website. you should comment only to answer the users question, not about semantics. – Joel Harkes Mar 27 '18 at 14:26
  • Also note, you do not have a unique constraint on customer.email_address, which means you could have multiple rows in contention for a query that you're expecting one from. – Alex Howansky Mar 27 '18 at 14:26
  • Yeah guys my code is not complete I am currently looking to fix this error before moving on further – user9512753 Mar 27 '18 at 14:27
  • try adding the ini_set('display_errors',1); error_reporting(E_ALL); – Nagesh Mar 27 '18 at 14:28
  • @FunkFortyNiner Hmm, well the sentiment is the same for both drivers. I'll try to make the wording more clear and look for a better example. – Alex Howansky Mar 27 '18 at 14:28
  • @AlexHowansky I can't see how `mysqli_real_escape_string()` can be bypassed by a potential hacker, unless there's something I don't know (yet). `mysql_`, yes... no doubt there. – Funk Forty Niner Mar 27 '18 at 14:30
  • @FunkFortyNiner In this particular case, the use is ok as far as I can tell. In the general case, it's a problem if you assume you have an int and you build your string with an unquoted value: `$sql = 'SELECT * FROM table WHERE id = ' . mysqli_real_escape_string(...);` – Alex Howansky Mar 27 '18 at 14:51
  • *Hm.....*, so you're saying that that can be hacked in that fashion? @AlexHowansky – Funk Forty Niner Mar 27 '18 at 14:52
  • @FunkFortyNiner I'm saying SQL can be injected in that fashion. I'll leave the definition of "hacked" up to you. :) – Alex Howansky Mar 27 '18 at 15:00
  • @AlexHowansky I hear ya ;-) – Funk Forty Niner Mar 27 '18 at 15:26

1 Answers1

1

You run the query:

$sql = "SELECT customer_id FROM customer WHERE email_adress = 'a@a.com' and password = 'a'";

this returns multiple results for $count = mysqli_num_rows($result); is thus > 1.

So you always fall into the else:

 if($count == 1) {

     $_SESSION['login_user'] = $myusername;

     header("location: index2.php");
  }else {
     $error = "Your Login Name or Password is invalid";
  }

Try for testing purposes try:

 if($count >= 1) {
     $_SESSION['login_user'] = $myusername;

     header("location: index2.php");
  }else {
     $error = "Your Login Name or Password is invalid";
  }

ofc later you will have to make sure you can't sign up email addresses twice.

Secondly you might want to forward to your session.php instead?

header("location:session.php"); // instead of index2.php
Joel Harkes
  • 10,975
  • 3
  • 46
  • 65
  • yes this worked thankyou. If i forward to session.php how will i direct the users to index2.php, will i change the header in session to index2.php instead of login.php? – user9512753 Mar 27 '18 at 14:35
  • @user9512753 you didnt share index2.php so i figured this is what you wanted. make sure you also start index2.php with `session_start();` otherwise you can't access session variables. – Joel Harkes Mar 27 '18 at 14:38
  • @user9512753 last side node: its handy/good practise to configure apache/php so that it will always redirect to same .php file in there you can route to other php files based on the URL (path) the user typed in. Eg: https://stackoverflow.com/a/18416136/1275832 – Joel Harkes Mar 27 '18 at 14:39
  • ah ok thank you. My plan is once the user has logged in they will be directed to index2.php with a new navigation bar from index.php. – user9512753 Mar 27 '18 at 14:40