How to fix PHP login?

Question

I have an index.php and a login function that gets opened when clicking on a submit button. Now whenever the button is being clicked, the user won't be logged in, as nothing is happening, and I can't figure out the issue.

Small snippet of index.php:

Username:<br> <img src="/images/figure.png" alt="Icon" height="42" width="42>">
    <input type="text" name="username"><br>
    Passwort:<br> <img src="/images/Key_lock.png" alt="Icon" height="42" width="42>">
    <input type="password" name="passwort"><br>
    <input type="submit" login="loginfunc()" value="Login">  
</form> 

and my loginfunc

<?php
session_start();
include 'globals.php';
if(empty($_POST["username"]) || empty($_POST["passwort"]))  
{  
    echo "Bitte tragen Sie ihr Passwort und Benutzername ein";
}  
else {  
       $query = "SELECT * FROM benutzer WHERE username = '$username'";  
       $result = mysqli_query($con, $query);  
       if(mysqli_num_rows($result) > 0)  
       {  
            while($row = mysqli_fetch_array($result))  
            {  
                 if(password_verify($passwort, $row["password"]))  
                 {      
                      session_start();
                      $_SESSION['username'] = $username;
                      header("Location:dashboard.php");     
                 }  
                 else  
                 {  
                    echo "Kevin";
                 }  
            }  
       }  
       else  
       {  

       }
}
?>

Answer 1

You’re never sending data to your PHP code (which, by the way, is not a function, based on what you’ve posted here). The login=loginfunc() that you have on your submit button isn’t valid HTML and doesn’t do anything. Besides, PHP is a server-side language. You can’t invoke it on the client like this.

You need to set an action parameter on your form tag, as in something like this:

<form method="POST" action="functions/loginfunc.php">

Also, you are wide open to SQL injection. You need to use prepared statements, rather than concatenating variables into your query. See How can I prevent SQL injection in PHP?.

You have other problems, like calling session_start() twice and, from the looks of it, some undefined variables ($username and $passwort, for starters).

All of the above is why you should not “roll your own” login/authentication logic; it’s too easy to get it wrong. Use an existing library if at all possible.

Edit based on your (now-deleted) "answer": You seem to have a few basic misunderstandings about how HTML and PHP work. The line

include_once("functions/loginfunc.php");

does not define a function; it just causes whatever is in loginfunc.php to execute immediately. In any case, you can't call a PHP function directly from HTML. And, again, the login=loginfunc() attribute on your button doesn't do—or tell the browser to do—anything. The browser does not go looking for something called login somewhere in your code; it just ignores that.

My best advice to you is this:

1. Do not attempt to create your own login functionality. It's extremely difficult to do it securely and correctly. And, frankly, this question makes clear that you do not know nearly enough about HTML, PHP, or the other issues involved to do it. Please understand: I'm not trying to insult you; I'm trying to help you avoid getting hacked horribly.

2. Go read and work through some basic HTML and PHP tutorials before going any further. You cannot do anything meaningful in PHP (or most other languages) if you do not know, for example, how to define a function.