Get Username from database after login

Question

I'm trying to login a user first, redirect them to an admin panel and then say something like "Good Morning Tim!".

Now to the problem: I use a session to login the user and the user then gets redirected to the admin panel, so I need to set a cookie with the username and lateron read the cookie on another site.

Here a bit of the code:

** Login-site PHP **

$viewable = true;
require_once( './includes/login.php' );

if( isset( $_POST[/*button*/'login'] ) ) {
    if( !empty( $_POST['user'] ) && !empty( $_POST['password'] ) ){
        login( $_POST['user'], $_POST['password'], $loginsite );
    }
}else if ( isset( $_POST['register'] ) ) {
    if( !empty( $_POST['user'] ) && !empty( $_POST['password'] ) ){
        register( $_POST['Benutzer'], $_POST['Passwort'] );
    }
}

** MySQL PHP ** <?php

require_once('utils.php');

class Connection {

private const server = 'ip';

private const username = 'user';

private const password = 'pw';

private const logindb = 'database';

private $mysqli;

private $debug;

function __construct( $debug = false )
{
    $this->mysqli = new mysqli( self::server, self::username,self::password, 'database' );
    $this->connect();
    $this->createTableIfNoExists();

    $this->debug = $debug;
}

private function connect(){
    if ( $this->mysqli->connect_error ) die( "That didn't work! Contact us." .$this->mysqli- 
>connect_error );
}

private function createTableIfNoExists() {
    //creates database 
$logindb
    $sql = "CREATE TABLE IF NOT EXISTS " . self::logindb . "(
        id INT AUTO_INCREMENT,
        name VARCHAR(255) NOT NULL,
        password VARCHAR(1024) NOT NULL,
        salt VARCHAR(128) NOT NULL,
        PRIMARY KEY(id)
    );";
    $this->mysqli->query( $sql );
}

//debug
private function debug( $msg ){
    if( $this->debug ){
        debug_to_console( $msg );
    }
}

//testet ob die anmeldung erfolgreich war
public function mysql_checkLogin( $name, $pw ){
    $this->debug( 'Checking Login of ' . $name . ' :: ' . $pw );
    $stmt = $this->mysqli->prepare( "SELECT name, password, salt FROM " . self::logindb . " WHERE 
 name = ?" );
    $stmt->bind_param( "s", $name );
    $stmt->execute();
    $stmt->store_result();
    if( $stmt->num_rows === 0 )
    {
        $stmt->close();
        $this->debug( 'Could not login' );
        return false;
    }
    $stmt->bind_result( $uname, $password, $salt );
    $stmt->fetch();
    $stmt->close();
    $enc = md5( $pw . $salt );
    $this->debug( 'Testing Hash' );
    $this->debug( 'Salt is ' . $salt );
    $this->debug( 'From Database: ' . $password );
    $this->debug( 'Encrypted    : ' . $enc );
    if( $enc === $password  && $uname === $name ) return true;
    return false;
}

And the admin panel:

<?php $erg = mysqli_query($db, "SELECT name FROM database");
            while($row = mysqli_fetch_object($erg)){
            $fullname=$row->name;
            $names = explode(" ",$fullname);
            echo $names[0];}

These days there's really no reason to write this functionality yourself, use a framework like laravel etc.. — Wesley Smith, Oct 03 '20 at 21:30
**Never store passwords in clear text or using MD5/SHA1!** Only store password hashes created using PHP's [`password_hash()`](https://php.net/manual/en/function.password-hash.php), which you can then verify using [`password_verify()`](https://php.net/manual/en/function.password-verify.php). Take a look at this post: [How to use password_hash](https://stackoverflow.com/q/30279321/1839439) and learn more about [bcrypt & password hashing in PHP](https://stackoverflow.com/a/6337021/1839439) — Dharman, Oct 03 '20 at 22:27
You seem to be confusing encryption with hashing. Please research more about security and if possible try to use some kind of framework like Laravel that does it for you. — Dharman, Oct 03 '20 at 22:28

score 0 · Answer 1 · answered Oct 04 '20 at 08:11

I got it to work with a cookie.

admin panel:

$cookie_name = "user";
$cookie_value = $uname;
setcookie($cookie_name, $cookie_value, time()+3600, "/", "domain.de/panel/", 1);


$fullname=$_COOKIE[$cookie_name];
$names = explode(" ",$fullname);
echo $names[0];

And I implemented

password_hash()

Thanks to Dharman!

Get Username from database after login

1 Answers1