[DavidIA]

Trying to make a login/register system for a windows application, Although it keeps returning 0? Idk if it has something to do with the MD5 encryption but i don't think it is. Tried on php 7.1 and 5.6 same result.


db.php

PHP Code


<?php

$host = "localhost";
$user = "user";
$pass = "pass";
$data = "db";

$con = new mysqli($host, $user, $pass, $data);

if($con->connect_errno)
{
    printf("Connect Failed: $n\n", $con->connect_error);
}

?>

Handler.php

PHP Code


<?php

include('db.php');

$action = $_GET['action'];

$username = $con->real_escape_string($_GET['username']);
$password = $con->real_escape_string(md5($_GET['password']));
if(!$action)
{
    echo "No Action";
}
else
{
    if($action == "register")
    {
        if($query = $con->query("INSERT INTO users (username,password) VALUES ('$username'.'$password')"))
        {
            echo "1";
        }
        else
        {
            echo "0";
        }
    }
    else if($action == "login")
    {
        $query = $con->query("SELECT * FROM users WHERE username = '$username' and password = '$password'");
        $cnt = $query->num_rows;
        
        if($cnt > 0)
        {
            echo "1";
        }
        else 
        {
            echo "0";
        }
    }

}

?>

[Nachfolger]

I would dump the values for $query->error and $con->error to see if it is a actual issue, or if it's simply not returning any rows.

There's a lot wrong with your code. If this is simply for playing around, then fine. But you should look into prepared statements, and legitimate password security measures.

[TCP]

This query

Code

INSERT INTO users (username,password) VALUES ('$username'.'$password')

Should be

Code

INSERT INTO users (username,password) VALUES ('$username','$password')

Even better you should use bind_param for prepared statements, for the login make sure the account is registered and print out errors as Nachfolger suggested

To make the password more safe you can do md5($password.$salt) where salt is a random string of your choice

[Squito]

In your insert there is a dot where a comma should be, therefore you try to insert one value into two fields.
Like Nachfolger suggested look at these things:
http://php.net/manual/en/ref.password.php
http://php.net/manual/en/mysqli.stmt-init.php

[DavidIA]

This query

Code

INSERT INTO users (username,password) VALUES ('$username'.'$password')

Should be

Code

INSERT INTO users (username,password) VALUES ('$username','$password')

Even better you should use bind_param for prepared statements, for the login make sure the account is registered and print out errors as Nachfolger suggested

To make the password more safe you can do md5($password.$salt) where salt is a random string of your choice

Yeh this is just temporary so i can test my program and sort of get everything in place. I'll probably use something like BetterSeal (if thats still going about, I haven't done any of this in over a year)
And thanks your solution worked 🤝

[phlex]

To make the password more safe you can do md5($password.$salt) where salt is a random string of your choice

I would go a step further an recommend using password_hash() and password_verify() (to OP). md5 w/ a salt is definitely more secure than just md5, but it's up to you. md5 is noticeably easier to crack compared to the more modern internal password_hash() by PHP.

[+Haze]

This query

Code

INSERT INTO users (username,password) VALUES ('$username'.'$password')

Should be

Code

INSERT INTO users (username,password) VALUES ('$username','$password')

Even better you should use bind_param for prepared statements, for the login make sure the account is registered and print out errors as Nachfolger suggested

To make the password more safe you can do md5($password.$salt) where salt is a random string of your choice

Dude stop giving programming advice, they suck. MD5 should not be used as a hashing algorithm, it's insecure and outdated. It doesn't matter if you're using a salt.

---

x

If you're creating this for learning purposes then sure carry on, but if this is to be used by anyone then I'd recommend you don't make your own authentication flow and just use OAuth or Open ID Connect. It allows for you to authenticate your users without having to worry about the security aspects that come with it, because judging by your code, you don't really understand proper security practices, so you shouldn't be handling sensitive user data.

If you want to learn more about security in web develoment then read up on OWSAP Top 10 guide.

[TCP]

Dude stop giving programming advice, they suck. MD5 should not be used as a hashing algorithm, it's insecure and outdated. It doesn't matter if you're using a salt.

You've been posting nothing but flames in this section, I give advices appropriate to the context I am posting in OP code is not the brightest anyway

[+Haze]

You've been posting nothing but flames in this section, I give advices appropriate to the context I am posting in OP code is not the brightest anyway

Okay, I'll work on not sounding so aggressive in my posts. However, my comment still stands, suggesting MD5 and telling him to generate his own salt is a bad idea.
http://php.net/manual/en/function.password-hash.php

Don't give me the excuse that OP may not understand something more complex, because suggesting MD5 is no different to suggesting password_hash() or password_verify() which is what is recommended.

[DavidIA]

Dude stop giving programming advice, they suck. MD5 should not be used as a hashing algorithm, it's insecure and outdated. It doesn't matter if you're using a salt.

---

If you're creating this for learning purposes then sure carry on, but if this is to be used by anyone then I'd recommend you don't make your own authentication flow and just use OAuth or Open ID Connect. It allows for you to authenticate your users without having to worry about the security aspects that come with it, because judging by your code, you don't really understand proper security practices, so you shouldn't be handling sensitive user data.

If you want to learn more about security in web develoment then read up on OWSAP Top 10 guide.

i'll have a look at it