0

code - not sure whats happening please help:

$accountname = $_POST['logname'];
$password = $_POST['logpassword']; 
echo '<br>';

$logsql = mysqli_query("SELECT Name FROM practice.users WHERE Name = $accountname and Password = $password;");
if (mysqli_num_rows($logsql) < 0) {
     echo 'Account doesnt exist';
}
else {
    echo 'Welcome ' . $accountname;
}
Grokify
  • 15,092
  • 6
  • 60
  • 81
Gaming Chipmunk
  • 9
  • 1
  • 3
    < 0 ? ............. – Andrew May 28 '18 at 20:59
  • How many rows are returned if there is no user? I doubt it's less than 0 ;) Also, the code is a huge security risk. You let form post data directly into your database query, which is very easy to attack with. https://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php/14110189#14110189 – James May 28 '18 at 20:59
  • 1
    Also this code does not work. `mysqli_query()` needs the connection parameter! – Qirel May 28 '18 at 21:00
  • ive just started and im just trying to get things working before i move on – Gaming Chipmunk May 28 '18 at 21:00
  • Fair enough, you have your answer so we're just letting you know because better to learn the correct way now rather than a wrong way as that's a waste of your time :) – James May 28 '18 at 21:01
  • whats a good way to learn – Gaming Chipmunk May 28 '18 at 21:02
  • 2
    This is virtually the same code with the same mistakes you posted 3 hours ago. – Nigel Ren May 28 '18 at 21:20
  • **Warning!** You are _wide open_ to [SQL Injections](http://php.net/manual/en/security.database.sql-injection.php) and should really use [Prepared Statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) instead of manually building your queries like that. Specially since you're not escaping the user inputs at all! – M. Eriksson May 28 '18 at 21:26
  • **Never store passwords in clear text!**. Only store password hashes! Use PHP's [`password_hash()`](http://php.net/manual/en/function.password-hash.php) and [`password_verify()`](http://php.net/manual/en/function.password-verify.php) . If you're running a PHP version lower than 5.5 (which I _really_ hope you aren't), you can use the [password_compat library](https://github.com/ircmaxell/password_compat) to get the same functionallity. – M. Eriksson May 28 '18 at 21:27
  • 2
    The above mentioned issues is the first thing you should address. Fixing them might solve your current issues, since it means that you need to refactor your code. There's never a good reason for knowingly writing insecure code and then waste more time debugging it. – M. Eriksson May 28 '18 at 21:28
  • 1
    Possible duplicate of [How to check if an account exists so it will let the person log in](https://stackoverflow.com/questions/50571626/how-to-check-if-an-account-exists-so-it-will-let-the-person-log-in) – Sam M May 29 '18 at 01:03

1 Answers1

-1
//wITHOUT TAKING SECURITY INTO CONSIDERATION AND BEST PRACTICESS CONSIDER BELOW

$accountname = $_POST['logname'];
$password = $_POST['logpassword']; 
echo '<br>';//WHY THIS LINE BREAK
//$logsql = mysqli_query("SELECT Name FROM practice.users WHERE Name = $accountname and Password = $password;");

// ADD A CONNECTION BEFORE A THE QUERY SEPERATED BY A COMMA
// ADD SINGLE QUOTES ON '$accountname' AND '$password' VARIABLES
$logsql = mysqli_query($connection, "SELECT Name FROM practice.users WHERE Name = '$accountname' AND Password = '$password'");
if (mysqli_num_rows($logsql) < 0) {
     echo 'Account doesnt exist';
}
else {
    echo 'Welcome ' . $accountname;
}
Chomba chanda
  • 11
  • 2