last day (14 days later) » 

12:11 PM
0
A: Mysqli and Php with session login form keep fail

RamRaiderThe index page seems more or less ok, a minor alteration to the use of isset and the inclusion of the login.php script. The check.php does an extra db lookup - you should be able just to use the session info to judge whether or not to redirect the user - so rather than echo $login_user in the ht...

 
Thank you a lot for your answer. I just tried your code, but I still get returned the same page. Is it because I do not have anything in the action tag? I have edited the tag to : <h1 class="hello">Hello, <em><?php echo $_SESSION['username'];?>!</em></h1>
 
I would say that is not the problem. I would test that you have set a session variable, in home.php, by adding session_start();exit($_SESSION['username']); at the top before check.php and try logging in
I think... the issue is that the submit button does not have a name and you test for $_POST['submit'] ~ give it a name submit and try
 
thank you. Okay when I add'ed session_start();exit($_SESSION['username']); and name="submit" I got to my index.php page, but I get Server error 500
 
it is because ( i have recreated your scripts ) the submit button lacks the name submit used in the logical tests. I got this all working here - that was the issue - hard to spot.
 
So I should use my original script?
okay good idea
 
12:12 PM
hi.. make the change to the submit button and try your original code
 
I think this is very hard, when I am not so good yet
okay 1 minut
 
it's ok - we were all beginners once too
 
So I just add name="submit" to the submit button
 
yes
 
okay now I get something else. I get Incorrect username or password
but It is correct. I copied from my database
 
12:15 PM
that's better
print out the sql before it gets executed and run in the gui
 
ehm, sorry but how do I do that?
 
exit( $sql );
 
In my login.php?
 
try that just before you execute the query, see what the resulting code looks like. yes, in logn.php
 
Does this say you anything?
SELECT uid FROM users WHERE username='' and password='d41d8cd98f00b204e9800998ecf8427e'
 
12:20 PM
there you go.. empty username -
 
ah
So the form is not sending my userid?
 
is that with your original code?
 
yes
 
before the exit( $sql ); statement do a print_r( $_POST ); to see what you get
 
Array ( [username] => test [password] => test [submit] => Login ) SELECT uid FROM users WHERE username='' and password='d41d8cd98f00b204e9800998ecf8427e'
 
12:31 PM
so the values are posted OK as I thought they would be.. the problem must be somewhere in the lines after you set the $username variable. I can't see anything with the code you posted in the question that looks obviously wrong. I would comment out the lines where you use mysqli_real_escape_string and stripslashes as a test ( for the username field )
or, better - use the code I posted that uses prepared statements
 
Just tried without mysqli_real_escape_string and stripslashes and get the same error
incorrect suername or password
 
something in your code is killing the variable $username. ignore sql injection prevention for testing just now and use $_POST['username'] in the sql - if that works then you should be able to figure why/where the variable $username is getting broken
 
like this?
// Define $username and $password
$username=$_POST['username'];
$password=$_POST['password'];
/*
// To protect from MySQL injection
$username = stripslashes($username);
$password = stripslashes($password);
$username = mysqli_real_escape_string($db, $username);
$password = mysqli_real_escape_string($db, $password);
$password = md5($password);
*/
//Check username and password from database
$sql="SELECT uid FROM users WHERE username='$_POST['username']' and password='$password'";
$result=mysqli_query($db,$sql);
 
$sql="SELECT uid FROM users WHERE username='$_POST['username']' and password='$password'";
exit( $sql );
$result=mysqli_query($db,$sql);
$row=mysqli_fetch_array($result,MYSQLI_ASSOC);
yes
 
Server error

500
it is crazy
 
12:44 PM
$username=$_POST['username'];
$password=$_POST['password'];


#$username = stripslashes($username);
#$password = stripslashes($password);
#$username = mysqli_real_escape_string($db, $username);

$password = mysqli_real_escape_string($db, $password);
$password = md5($password);


$sql="SELECT uid FROM users WHERE username='{$_POST['username']}' and password='$password'";
exit( $sql );
$result=mysqli_query($db,$sql);
$row=mysqli_fetch_array($result,MYSQLI_ASSOC);
 
still Server error

500
is it time to give up you think?
 
never give up
 
okay, maybe you were tired :)
 
added curly braces around $_POST
no, you are ok - I'd like to help fix the error for you
 
thank you a lot. I would do everything to make it work
now I get to the page: SELECT uid FROM users WHERE username='test' and password='d41d8cd98f00b204e9800998ecf8427e'
 
12:47 PM
seems better
so there is some issue with the $username = stripslashes($username); &/or mysqli_real_escape_string($db, $username); ~ it all looks ok though so bit confuzzled about that not working
 
when I remove the # # # from $username = stripslashes($username);
$password = stripslashes($password);
$username = mysqli_real_escape_string($db, $username);
ah no nothing
 
do you still have {$_POST['username']} in the sql though?
 
yes
i remove it now
i remove it now: SELECT uid FROM users WHERE username='test' and password='d41d8cd98f00b204e9800998ecf8427e'
so it is taking my username?
 
$username=mysqli_real_escape_string( $db, $_POST['username'] );
$password=md5( mysqli_real_escape_string( $db, $_POST['password'] ) );

$sql="SELECT uid FROM users WHERE username='{$username}' and password='{$password}';";
what's the latest?
 
1:03 PM
a blank page
suddenly my form fields are gone
Is there a page where I can post my code as it is now?
 
paste it here... the fact that the fields have disappeared is good ( sort of ) - it means that the session must be getting set
 
index.php:
<?php
include('login.php'); // Include Login Script

if(isset($_SESSION['username']))
{
header('Location: home.php');
}
exit();
?>

<!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>PHP Login Form with Session</title>
<link rel="stylesheet" href="style.css" type="text/css" />
</head>

<body>
<h1>PHP Login Form with Session</h1>
<div class="loginBox">
<h3>Login Form</h3>
<br><br>
<form method="post" action="">
<label>Username:</label><br>
<input type="text" name="username" placeholder="username" /><br><br>
login.php:
<?php
session_start();
include("dbconfic.inc.php"); //Establishing connection with our database

$error = ""; //Variable for storing our errors.
if(isset($_POST["submit"]))
{
if(empty($_POST["username"]) || empty($_POST["password"]))
{
$error = "Both fields are required.";
}else
{
// Define $username and $password
$username=mysqli_real_escape_string( $db, $_POST['username'] );
$password=md5( mysqli_real_escape_string( $db, $_POST['password'] ) );

$sql="SELECT uid FROM users WHERE username='{$username}' and password='{$password}';";
check.php:
<?php
include('dbconfic.inc.php');
session_start();
$user_check=$_SESSION['username'];

$sql = mysqli_query($db,"SELECT username FROM users WHERE username='$user_check' ");

$row=mysqli_fetch_array($sql,MYSQLI_ASSOC);

$login_user=$row['username'];

if(!isset($user_check))
{
header("Location: index.php");
}
?>
 
which page are you on though? index.php or home.php?
 
index
but when i go to localhost and click on my folder as i use to, i just get a blank page. other sites on localhost works fine
when I click on my folder in localhost i get my index page but it is blank
i found out
I removed the exit(); in my header :-/ sorry for that
So my code is like above now and I have my forms
and still the error with incorrect userid og password
 
1:19 PM
mm-designlab.co.uk/loginsystem.zip - these are copies ( in a zip file ) of the files I have here and that work here
 
ok cool thanks a lot. I am gonna try that now
I just tried to copy all the code, and now I do not get incorrect name or password. THe index page just reload. There must be something wrong with my localhost or something, when it is working at your computer
 
for me it logs in and redirects to home.php and displays hello <USERID> logout
 
is my connection also okay?
dbconfic.inc.php:
<?php
$db_host = "localhost";
$db_user = "root";
$db_pass = "root";
$db_name = "testdb";
// connection:
$mysqli = new mysqli($db_host, $db_user, $db_pass , $db_name);
// tjek conenction:
if (mysqli_connect_errno()) {
printf("Connect failed: %s\n", mysqli_connect_error());
}

// vi kører utf-8 på connection:
$mysqli->set_charset("utf-8");
?>
 
this is my version of it

$dbhost = 'localhost';
$dbuser = 'root';
$dbpwd = 'xxx';
$dbname = 'xxx';

$db = new mysqli( $dbhost, $dbuser, $dbpwd, $dbname );
obviously i xxx out the actual values for pwd and dbname
 
neither that. Is it because I have to delete a cache somewhere or something?
 
1:27 PM
nope - shouldn't be... though your session variables will still be set.
you can always unset them by unset( $_SESSION['username'] );
 
1:38 PM
Your check.php is no different than mine?
<?php
include('dbconfic.inc.php');
session_start();
$user_check=$_SESSION['username'];

$sql = mysqli_query($db,"SELECT username FROM users WHERE username='$user_check' ");

$row=mysqli_fetch_array($sql,MYSQLI_ASSOC);

$login_user=$row['username'];

if(!isset($user_check))
{
header("Location: index.php");
}
?>
 
i didn't include check.php as I believe it is unneccessary - use session variables at that point to check that the user is valid
you'll notice in home.php the line that includes check.php is commented out
 
i am just gonna restart my computer
do you want to stop it
You have done a lot
so myabe I should just see what is gonna happen
 
on you go - hopefully you can rejoin the chat once you have restarted your pc
it's fine - happy to help
 
i just rebooted my server, so it is okay now
I just dont know where to look anymore
when there is no response at all
not even incorrect username or password
It is not something with the database right? it must be the code
I just made a new folder with only your code in and my dbconfic
just to start on a clean one
 
are the db connection details ok?
 
1:51 PM
yes they are fine. Just tested it
 
ok - are you using your original code or my versions of the pages?
 
I am using your version
from your documents
 
ok. the index page - can you see the form?
 
yes
I hit submit and the page is just reloaded
 
are all the files in the same directory?
 
1:54 PM
yes
my foldername is logintest and here are all my files
I just want to make sure one thing
How do you test if there is connection to the db
 
ok. at the bottom of login.php before if( isset( $_SESSION['username'] ) ) add exit($login_user);
your db connection has error checking in - if the connection fails there should be some sort of message displayed
 
* bind the result of the query to a variable */
$stmt->bind_result( $login_user );
while( $stmt->fetch() ){
/* go through recordset ( 1 record ) */
$_SESSION['username'] = $login_user;
}

$stmt->close();
$db->close();
exit($login_user);
if( isset( $_SESSION['username'] ) ) exit( header( 'location: home.php' ) );
else $error='Incorrect username or password.';
still the same
 
does it not get to the exit statement?
 
no
just reload page
 
this is frustrating isn't it?
 
2:00 PM
really a lot
it is crazy
Specially when It works at your computer.
I should get an error if I was not connected with the exit($login_user);
 
If I have this sort of problem I use exit('ok: 1'); , exit('ok: 2');statements at various points throughout the code and see how far I get. Once I get to the first statement I will comment it out and try again until I find the point that is breaking
yep - it all works fine on my laptop
just going to make a cup of tea... :)
 
Yes me to :)
I am just gonna restart my computer
 
2:20 PM
I am back again
 
welcome back
 
i am just gonna test again now after restart
did you get your tea?
 
oh yes - cup of tea in hand thanks!
 
sounds noce
nice
omg it is still the same. i was hoping a littel bit for something
 
have you checked in the apache error log ( i assume it is apache )
btw -if you are from Denmark I must say that your English is exceptionally good.
 
2:28 PM
Yes I am, and thank you :) Where are you from?
My folder "logs" are empty in apache folder
 
I live in Scotland. Check your PHP log file next
 
hey
there is something in the log now
 
hopefully it should tell us what the error is and on what line
 
160131 15:20:46 mysqld_safe Starting mysqld daemon with databases from /Applications/MAMP/db/mysql
160131 15:20:46 [Warning] Setting lower_case_table_names=2 because file system for /Applications/MAMP/db/mysql/ is case insensitive
160131 15:20:46 [Note] Plugin 'FEDERATED' is disabled.
160131 15:20:46 InnoDB: The InnoDB memory heap is disabled
160131 15:20:46 InnoDB: Mutexes and rw_locks use GCC atomic builtins
160131 15:20:46 InnoDB: Compressed tables use zlib 1.2.3
160131 15:20:46 InnoDB: Initializing buffer pool, size = 128.0M
Mysql error log
 
that's the mysql log
 
2:35 PM
there is also a php file
and apache log
 
peculiar that the address is 0.0.0.0
yep, we need to see `php_errors.log or whatever you have called it
 
the php error says a lot of:
[31-Jan-2016 15:31:18 Europe/Berlin] PHP Warning: include(): Failed opening '/Applications/MAMP/htdocs/login\login.php' for inclusion (include_path='.:/Applications/MAMP/bin/php/php5.6.2/lib/php') in /Applications/MAMP/htdocs/login/index.php on line 5
 
does line 5 relate to include( __DIR__ . '\\dbconfic.inc.php' );
 
yes
 
is that in the same directory?
 
2:37 PM
yes
 
try with your original include('dbconfic.inc.php');
 
just tried
the same
 
set_include_path( $_SERVER['DOCUMENT_ROOT'].'/login/' );
include('dbconfic.inc.php');
it's a Mac is it?
 
yes it is
 
ah.. hang on
 
2:40 PM
like this:


if( !isset( $_SESSION ) ) session_start();
set_include_path( $_SERVER['DOCUMENT_ROOT'].'/login/' );
include('dbconfic.inc.php');
 
I misread the error message
it cannot find login.php
so, on index.php change to if( !isset( $_SESSION[ $svar ] ) ) include('login.php' );
 
<?php
$error='';
if( !isset( $_SESSION ) ) session_start();

if( !isset( $_SESSION[ $svar ] ) ) include( DIR . '/login.php' );
else exit( header('Location: home.php') );
?>
like this?
 
'login.php'
no slash - it's in the same directory
include( 'login.php' );
 
f( !isset( $_SESSION[ $svar ] ) ) include('login.php' );
else exit( header('Location: home.php') );
 
if
if( !isset(.........
 
2:44 PM
ops
 
it's ok
 
if( !isset( $_SESSION[ $svar ] ) ) include('login.php' );
else exit( header('Location: home.php') );
?>
 
go for it - give it a try ( crossing my fingers )
 
still the same :(
 
hang on - you don't need the $svar - that is in my code only - replace with 'username'
i'm sorry
if( !isset( $_SESSION[ 'username' ] ) ) include( 'login.php' );
 
2:48 PM
<?php
$error='';
if( !isset( $_SESSION ) ) session_start();

if( !isset( $_SESSION[ 'username' ] ) ) include( 'login.php' );
else exit( header('Location: home.php') );
?>
right?
 
think so... fingers crossed again
 
and the login.php:

<?php
/* login.php */

if( !isset( $_SESSION ) ) session_start();
include('dbconfic.inc.php' );
 
looks ok
 
[31-Jan-2016 15:49:49 Europe/Berlin] PHP Warning: include(): Failed opening '/Applications/MAMP/htdocs/login\login.php' for inclusion (include_path='.:/Applications/MAMP/bin/php/php5.6.2/lib/php') in /Applications/MAMP/htdocs/login/index.php on line 5
 
eyes, legs, toes and fingers crossed
 
2:50 PM
:-/ same again
 
that is the same as before
 
yes
why is there a \ instead of a /
 
not sure
set_include_path( $_SERVER['DOCUMENT_ROOT'] . '/login/' );
if( !isset( $_SESSION[ 'username' ] ) ) include( 'login.php' );
you must be getting frustrated now - probably with me
 
No I am just very honored that you want to spend your time on it
I would really do anything to try it on another computer
 
I want this solved !
 
2:55 PM
yes me to :-/
Applications/MAMP/htdocs/login\login.php' for inclusion (include_path='.:/Applications/MAMP/bin/php/php5.6.2/lib/php') in /Applications/MAMP/htdocs/login/index.php on line 5
it is just weird when we at least got a response earlier on with invalid userid
now I get server error 500
at least something is happeing
[31-Jan-2016 15:58:14 Europe/Berlin] PHP Fatal error: Call to a member function prepare() on null in /Applications/MAMP/htdocs/logintest/login.php on line 23
fuck
 
ok... now are getting somewhere else which must be good.
 
I am so sorry
I had a folder called login and logintest. The logintest was your code, but since I have restarted my computer, I have been updateting the wrong index file
sorry
 
:)
so, are you making changes just now to the other files?
 
I made the changes you wrote her in the right documents, but I updated the wrong page in my localhost. Should I just post the code as it is now?
[31-Jan-2016 16:02:41 Europe/Berlin] PHP Fatal error: Call to a member function prepare() on null in /Applications/MAMP/htdocs/logintest/login.php on line 23
that is the : $stmt=$db->prepare( $sql );
I know what that is, 2 sec
can you post your database again?
 
my db connection file?
 
3:06 PM
yes
please
:)
 
$dbhost = 'localhost';
$dbuser = 'root';
$dbpwd = 'xxx';
$dbname = 'xxx_innodb';

$db = new mysqli( $dbhost, $dbuser, $dbpwd, $dbname );
 
thanks
server error 500
 
make sure that the db connection file is being included properly - hopefully there would be errors in the log to say it could not be found if it failed.
f**k
check the log
 
no
Incorrect username or password.
 
where does it say that?
 
3:11 PM
when i hit submit
php error:
31-Jan-2016 16:10:11 Europe/Berlin] PHP Strict Standards: Only variables should be passed by reference in /Applications/MAMP/htdocs/logintest/login.php on line 29
$stmt->bind_param('ss', $_POST['username'], md5( $_POST['password'] ) );
but at least something is happening now :)
 
ah! I know
i think
 
hey
fuck
it works now, i removed the md5?
 
$username=$_POST['username'];
$password=md5( $_POST['password'] );

$stmt->bind_param('ss', $username, $password );
$res=$stmt->execute();
fingers, eyes, legs, ears, toes and other things crossed
 
incorrect userid or password, hehe :-/
but why is it working like this
$stmt->bind_param('ss', $_POST['username'], ( $_POST['password'] ) );
$res=$stmt->execute();
without md5
 
the statement gets executed ok but there are no matching records - hence no session set
oh... is the password stored in the hashed form in the database?
 
3:19 PM
ehm good question
I just added test in code
in db
varchar
or i just added a normal varchar column in the database
 
and what is the actual password stored in the db
 
user: test password: test
 
Ok. so, the sql should probably be something like:

select `uid` from `users` where `username`=? and md5( `password` )=? limit 1

if you use `md5( $password )`
 
you know what?
 
tell me
 
3:28 PM
it is working now :)
 
fantastic
 
I am laughin right now, hihi. I cannot belive it
 
that only took most of the day
 
It is crazy
 
don't you just love programming!?
 
3:29 PM
Actually yes , hihi. But I am just so happy that I can start on something new now with the page
 
so, does the login system work from end to end now?
 
So my sessions are working now
yes it does :)
 
and the logout?
 
works perfect :)
so every time I make a new page, where the user has to be signed in, then
 
:-)*
 
3:31 PM
I have to add:
if( !isset( $_SESSION ) ) session_start();
include('dbconfic.inc.php' );
I fx make a page called: shop.php
<?php


?>

<html>
<?php
if( !isset( $_SESSION ) ) session_start();
include('dbconfic.inc.php' );
?>

<html>
<head>
</head>
<body>
</body>
</html>
 
perhaps more like on home.php

if( !isset( $_SESSION ) ) session_start();
if( !isset( $_SESSION[ 'username' ] ) ) exit( header('Location: index.php') );
include( 'dbconfic.inc.php' );
never put the session_start in the html ~ always before any html content
 
And that means if the session is not set, the user x get returned to index.php
oh yes sorry my mistake
 
never send headers ( there are caveats to that ) once any html has been started
yes, the user should be returned to the index page if the session is not set so they can login
you can and probably should use an expiry mechanism in the session too ~ ie:
$_SESSION['lastactive']=time(); update with every request and if the session has not been updated for 20minutes etc then log out
 
ah okay. I will start looking in to that. Is there somewhere where I can see that I am still logged in my session. I just tried to make a test page, and it looks like it is worked.
 
" I have been looking at the code for 10 hours now" - make that 15!
print_r( $_SESSION );
 
3:39 PM
haha yes truley
I thank you so much for your help. I wish there was something I could do for you
good good, now I can see that on my new page I get the array printed Array ( [username] => 1 ) Logout?
perfect
I am so happy
 
it's up to you if you accept the answer I posted before ~ it's close to where you are now but other changes made here are not reflected in original so it's up to you. I'm happy that you are happy - if you ever come to scotland I'l take you out for dinner. Good luck with the coding - if you have other problems no doubt you'll post questions and if I see them I'll try to help again
glad you have this sorted now
 
I will have that on my mind, it could be really nice ;) Thank you again, and I will green tick your answer and write a comment, after I have eaten. Thank you again, and hope to see you around :)
 
now I think I should get away from the computer and go for a walk or something... you are welcome Julie24
probably shouldn't but, Inf0nautster@gmail.com if you can't get an answer on stack
 
3:59 PM
Thank you a lot, you are really sweet :)
have a great walk and hope it is not to cold
 

last day (14 days later) »