Login system PHP

[Bartb56]

I'm trying to make a login system in PHP but it keeps saying my login is wrong please help.

<?php
    session_start();
    include('dbconn.php');

    $username= $_POST['username'];
    $password= $_POST['password'];

    $username = stripslashes($username);
    $password = stripslashes($password);
    $username = mysql_real_escape_string($username);
    $password = mysql_real_escape_string($password);

 

    $result = mysqli_query($con, "SELECT username, password FROM users WHERE username = '".$username."' AND password = '".$password."'");

    $count =mysql_num_rows($result);
        
    if ($count==1){
        header("Location: index.html");
    } else {
        echo"Nope";
    }
?>

[leonfagan71]

1 minute ago, Bartb56 said:

I'm trying to make a login system in PHP but it keeps saying my login is wrong please help.

 

<?php
    session_start();
    include('dbconn.php');

    $username= $_POST['username'];
    $password= $_POST['password'];

    $username = stripslashes($username);
    $password = stripslashes($password);
    $username = mysql_real_escape_string($username);
    $password = mysql_real_escape_string($password);

 

    $result = mysqli_query($con, "SELECT username, password FROM users WHERE username = '".$username."' AND password = '".$password."'");

    $count =mysql_num_rows($result);
        
    if ($count==1){
        header("Location: index.html");
    } else {
        echo"Nope";
    }
?>

 

You're using mysql_real_escape_string, change this to:

$username = mysqli_real_escape_string($con, $username);

for example.

also, mysql_num_rows needs to be mysqli_num_rows

 

If you still have issues, PM me.

Regards,
Leon.

[Cruorzy]

Once it works you can look into https://stackoverflow.com/questions/30279321/how-to-use-password-hash

[Cruorzy]

I would recommend using prepared statements instead of escaping

 

https://stackoverflow.com/questions/24716560/do-i-need-to-escape-my-variables-if-i-use-mysqli-prepared-statements

Quote

No, if you use prepared statements everywhere in your application you are safe from SQL injection. However, an important "gotcha" is 2nd order injection attacks which happen when some queries use prepared statements and others don't.