[VipVince]

I am by no means an expert in PHP, however I am doing my best to learn and become better at it. I decided to make a login system, this way I will get my hands dirty working with sessions, security concepts, and other web app fundamentals that can benefit me. I know plenty of login scripts have been made before, but I just wanted to make one that I can use myself in the future. This script is currently giving me two issues however:

1. Is not writing values to the database
2. The email check is not working, I can register the same email twice.

It seems the more I look at it, the less I can see.

Perhaps some of you guys can fix it up.

PHP Code


<?php 
<!DOCTYPE html>
<html>

<head>
<title>Registation page</title>
</head>

<body>

<?php
$dbhost     = "localhost";
$dbname     = "membersdb";
$dbuser     = "root";
$dbpass     = "";

// database connection
$conn = new PDO("mysql:host=$dbhost;dbname=$dbname",$dbuser,$dbpass);

if (empty($_POST['username']) || empty($_POST['password']) || empty($_POST['password2']) || empty($_POST['email'] ))
  {
  die("Error: All fields must be filled in!");
  }

else
{

$username = htmlentities($_POST['username']);
$password = $_POST['password'];
$password2 = $_POST['password2'];
$email= htmlentities($_POST['email']);

if(!filter_var($email, FILTER_VALIDATE_EMAIL))
{
  die("Error: E-mail address is not valid!");
}

if (strlen($username)>15) {
die("Username character limit exceeded!");
}

if (strlen($username)<6) {
die("Username must contain more than 5 characters!");
}

if (strlen($password)<6) {
die("Password must contain more than 5 characters!");
}

if (strlen($email)>30) {
die("Email character limit exceeded!");
}

//secure the password
$salt = '-45dfeHK/__yu349@-/klF21-1_\/4JkUP/4';
$hashedpass = sha1($salt.$password);
$hashedpass2 = sha1($salt.$password2);

if($hashedpass !== $hashedpass2)
{
die("Error: Passwords do not match!");
}

$stmt = $conn->prepare("SELECT username FROM members WHERE username = :name");
$stmt->bindParam(':name', $username);
$stmt->execute();

if($stmt->rowCount() > 0){
die("Username: $username already exists!");
}

$stmt = $conn->prepare("SELECT email FROM members WHERE email = :email");
$stmt->bindParam(':email', $email);
$stmt->execute();

if($stmt->rowCount() > 0){
die("Email: $email already exists in our database!");
}

else {

//get data ready for db insert
$sql = "INSERT INTO members (username, password, email) VALUES (:username, :password, :email)";
//prepare statement
$q = $conn->prepare($sql);
//execute statement, with variable data to placeholders
$q->execute(array(':username'=>$username,':password'=>$hashedpass, ':email'=>$email));

echo "Thank you for registering! <a href='login2.php'>Click here to login</a>";
      }
     }

?>

</body>
</html> 


Thanks in advance. VV.

[Idle cares]

From the php.net's pdo rowcount() page:

For most databases, PDOStatement::rowCount() does not return the number of rows affected by a SELECT statement. Instead, use PDO::query() to issue a SELECT COUNT(*) statement with the same predicates as your intended SELECT statement, then use PDOStatement::fetchColumn() to retrieve the number of rows that will be returned. Your application can then perform the correct action.

So you can't use the function in the way you're attempting to.
What you can do, as they've explained is something like:

PHP Code


<?php
$sql = "SELECT COUNT(*) FROM fruit WHERE calories > 100";
if ($res = $conn->query($sql)) {

    /* Check the number of rows that match the SELECT statement */
  if ($res->fetchColumn() > 0) {

      /* Issue the real SELECT statement and work with the results */
      $sql = "SELECT name FROM fruit WHERE calories > 100";
      foreach ($conn->query($sql) as $row) {
      print "Name: " .  $row['NAME'] . "\n";
      }
    }
    /* No rows matched -- do something else */
  else {
      print "No rows matched the query.";
    }
}

$res = null;
$conn = null;
?>

Edit: just put the code directly from the rowCount() page, it was better than my own >.<

[La Manifesto]

You can use SQL's built in COUNT to check the count.

PHP Code


<?php 
$stmt = $conn->prepare("SELECT COUNT(`username`) FROM members WHERE `username` = :name");
$stmt->execute(array(':name' => $username));

if ($stmt->fetch(PDO::FETCH_COLUMN) >= 1)
{
    die("Username: $username already exists!");
} 


And do the same for email. Also why the random else before the INSERT query?

[The Alchemist16]

This should work :

PHP Code


<?php 
<!DOCTYPE html>
<html>

<head>
<title>Registation page</title>
</head>

<body>

<?php
$dbhost     = "localhost";
$dbname     = "membersdb";
$dbuser     = "root";
$dbpass     = "";

// database connection
$conn = new PDO("mysql:host=$dbhost;dbname=$dbname",$dbuser,$dbpass);

if (empty($_POST['username']) || empty($_POST['password']) || empty($_POST['password2']) || empty($_POST['email'] ))
  {
  die("Error: All fields must be filled in!");
  }

$username = $_POST['username'];
$password = $_POST['password'];
$password2 = $_POST['password2'];
$email= $_POST['email'];

if(!filter_var($email, FILTER_VALIDATE_EMAIL)){
  die("Error: E-mail address is not valid!");
}

if($password != $password){
  die("The two passwords entered do not match");
}
if (strlen($username)>15) {
die("Username character limit exceeded!");
}

if (strlen($username)<6) {
die("Username must contain more than 5 characters!");
}

if (strlen($password)<6) {
die("Password must contain more than 5 characters!");
}

if (strlen($email)>30) {
die("Email character limit exceeded!");
}

//secure the password
$salt = '-45dfeHK/__yu349@-/klF21-1_\/4JkUP/4';
$hashedpass = sha1($salt.$password);

$stmt = $conn->prepare("SELECT * FROM members WHERE username = :name");
$stmt->execute(array('name', $username));

if($stmt->rowCount() > 0){
die("Username: ".htmlspecialchars($username)." already exists!");
}

$stmt = $conn->prepare("SELECT * FROM members WHERE email = :email");
$stmt->execute(array('email', $email));

if($stmt->rowCount() > 0){
die("Email: ".htmlspecialchars($email)." already exists in our database!");
}

//get data ready for db insert
$sql = "INSERT INTO members (username, password, email) VALUES (:username, :password, :email)";
//prepare statement
$q = $conn->prepare($sql);
//execute statement, with variable data to placeholders
$q->execute(array('username' => $username, 'password' => $hashedpass, 'email' => $email));

echo "Thank you for registering! <a href='login2.php'>Click here to login</a>";

?>

</body>
</html> 


I dont know why nothing is getting inserted. Your table should be like this :

Code

CREATE TABLE IF NOT EXISTS members (id INT NOT NULL AUTO_INCREMENT PRIMARY KEY, email VARCHAR(30), username VARCHAR(30), password CHAR(40))

Havent really tested them. But they SHOULD work.

[Idle cares]

PHP Code


<?php 
code blah 


I dont know why nothing is getting inserted. Your table should be like this :

Code

CREATE TABLE IF NOT EXISTS members (id INT NOT NULL AUTO_INCREMENT PRIMARY KEY, email VARCHAR(30), username VARCHAR(30), password CHAR(40))

Havent really tested them. But they SHOULD work.

Password field should be larger. By quite a bit :) OP should also take a look at password_hash

PASSWORD_DEFAULT - Use the bcrypt algorithm (default as of PHP 5.5.0). Note that this constant is designed to change over time as new and stronger algorithms are added to PHP. For that reason, the length of the result from using this identifier can change over time. Therefore, it is recommended to store the result in a database column that can expand beyond 60 characters (255 characters would be a good choice).

I got ahead of myself in my first post and forgot about your second issue.
Try out this code, and it will spit out any errors.

PHP Code


<?php 
        $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        $conn->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
        try
        {
            //get data ready for db insert
            $sql = "INSERT INTO members (username, password, email) VALUES (:username, :password, :email)";
            //prepare statement
            $q = $conn->prepare($sql);
            //execute statement, with variable data to placeholders
            $q->execute(array(':username' => $username, ':password' => $hashedpass, ':email' => $email));
        } catch (PDOException $e)
        {
            print_r($e);
        } 


[VipVince]

Made some changes, however for some reason email is still able to be registered twice nor data being saved to db ^_^. It tells me it has though with the "thanks for registering" bla bla.

PHP Code


<?php 
<!DOCTYPE html>
<html>

<head>
<title>Registation page</title>
</head>

<body>

<?php
$dbhost     = "localhost";
$dbname     = "membersdb";
$dbuser     = "root";
$dbpass     = "";

// database connection
$conn = new PDO("mysql:host=$dbhost;dbname=$dbname",$dbuser,$dbpass);

if (empty($_POST['username']) || empty($_POST['password']) || empty($_POST['password2']) || empty($_POST['email'] ))
  {
  die("Error: All fields must be filled in!");
  }

else
{

$username = htmlentities($_POST['username']);
$password = $_POST['password'];
$password2 = $_POST['password2'];
$email= htmlentities($_POST['email']);

if(!filter_var($email, FILTER_VALIDATE_EMAIL))
{
  die("Error: E-mail address is not valid!");
}

if (strlen($username)>15) {
die("Username character limit exceeded!");
}

if (strlen($username)<6) {
die("Username must contain more than 5 characters!");
}

if (strlen($password)<6) {
die("Password must contain more than 5 characters!");
}

if (strlen($email)>30) {
die("Email character limit exceeded!");
}

//secure the password
$salt = '-45dfeHK/__yu349@-/klF21-1_\/4JkUP/4';
$hashedpass = sha1($salt.$password);
$hashedpass2 = sha1($salt.$password2);

if($hashedpass !== $hashedpass2)
{
die("Error: Passwords do not match!");
}

$stmt = $conn->prepare("SELECT COUNT(`username`) FROM members WHERE `username` = :name");
$stmt->execute(array(':name' => $username));

if ($stmt->fetch(PDO::FETCH_COLUMN) >= 1)
{
    die("Username: ".htmlentities($username)." already exists in our database!");
}

$stmz = $conn->prepare("SELECT COUNT(`email`) FROM members WHERE `email` = :email");
$stmz->execute(array(':email' => $email));

if ($stmz->fetch(PDO::FETCH_COLUMN) >= 1)
{
    die("Email: ".htmlentities($email)." already exists in our database!");
}

//get data ready for db insert
$sql = "INSERT INTO members (username, password, email) VALUES (:username, :password, :email)";
//prepare statement
$q = $conn->prepare($sql);
//execute statement, with variable data to placeholders
$q->execute(array(':username'=>$username,':password'=>$hashedpass, ':email'=>$email));

echo "Thank you for registering! <a href='login2.php'>Click here to login</a>";

 }

?>

</body>
</html> 


Thanks for the contributions guys.

Edit: records are now being saved fine.

Only issue remaining is the email check.

Edit, solved. All working fine.

Thanks again, going to do some more reading and further implementations :).

[La Manifesto]

Any way that we could see your table?

[VipVince]

Any way that we could see your table?

Sure.
[img]http://#/ikXq8Y.jpg[/img]

---

I have a very simple login script now, that allows the user to login after registering. Its still in the basic stages and insecure, I want to have the theory working 100% before adding other features like sessions etc.

When I attempt to login with a registered username and password, it is telling me that it has been unsuccessful. However, when I go into my database and change the hashed password to plain text, and attempt the login again it is successful. So I think the hashing is the issue. Here is the four scripts, perhaps someone can see the issue.

Register form.

PHP Code


<?php 
<form action="checkregister.php" method="POST">
    Username<br>
    <input type="text" name="username" /><br>
    Password<br>
    <input type="password" name="password" /><br>
    Re-Enter Password<br>
    <input type="password" name="password2" /><br>
    Email<br>
    <input type="text" name="email" /><br>
    <input type="submit" value="Register" />
    </form> 


checkregister.php

PHP Code


<?php 
<!DOCTYPE html>
<html>

<head>
<title>Registation page</title>
</head>

<body>

<?php
$dbhost     = "localhost";
$dbname     = "mymembers";
$dbuser     = "root";
$dbpass     = "";

// database connection
$conn = new PDO("mysql:host=$dbhost;dbname=$dbname",$dbuser,$dbpass);

if (empty($_POST['username']) || empty($_POST['password']) || empty($_POST['password2']) || empty($_POST['email'] ))
  {
  die("Error: All fields must be filled in!");
  }

else
{

$username = htmlentities($_POST['username']);
$password = $_POST['password'];
$password2 = $_POST['password2'];
$email= htmlentities($_POST['email']);

if(!filter_var($email, FILTER_VALIDATE_EMAIL))
{
  die("Error: E-mail address is not valid!");
}

if (strlen($username)>15) {
die("Username character limit exceeded!");
}

if (strlen($username)<6) {
die("Username must contain more than 5 characters!");
}

if (strlen($password)<6) {
die("Password must contain more than 5 characters!");
}

if (strlen($email)>30) {
die("Email character limit exceeded!");
}

//secure the password
$salt = '-45dfeHK/__yu349@-/klF21-1_\/4JkUP/4';
$hashedpass = sha1($salt.$password);
$hashedpass2 = sha1($salt.$password2);

if($hashedpass !== $hashedpass2)
{
die("Error: Passwords do not match!");
}

//check if the username is already registered.
$stmt = $conn->prepare("SELECT COUNT(`username`) FROM members WHERE `username` = :name");
$stmt->execute(array(':name' => $username));

if ($stmt->fetch(PDO::FETCH_COLUMN) >= 1)
{
    die("Username: ".htmlentities($username)." already exists in our database!");
}

//check if the email is already registered.
$stmz = $conn->prepare("SELECT COUNT(`email`) FROM members WHERE `email` = :email");
$stmz->execute(array(':email' => $email));

if ($stmz->fetch(PDO::FETCH_COLUMN) >= 1)
{
    die("Email: ".htmlentities($email)." already exists in our database!");
}

//get data ready for db insert
$sql = "INSERT INTO members (username, password, email) VALUES (:username, :password, :email)";
//prepare statement
$q = $conn->prepare($sql);
//execute statement, with variable data to placeholders
$q->execute(array(':username'=>$username,':password'=>$hashedpass, ':email'=>$email));

echo "Thank you for registering ".htmlentities($username)."! <a href='login.php'>Click here to login</a>";

 }

?>

</body>
</html> 


loginform

PHP Code


<?php 
<form action="checklogin.php" method="POST">
    Username<br>
    <input type="text" name="username" /><br>
    Password<br>
    <input type="password" name="password" /><br>
    <input type="submit" value="Login" />
    </form> 


checklogin.php

PHP Code


<?php

    $dbhost     = "localhost";
    $dbname     = "mymembers";
    $dbuser     = "root";
    $dbpass     = "";

    // database connection
    $conn = new PDO("mysql:host=$dbhost;dbname=$dbname",$dbuser,$dbpass);

    $username = $_POST['username'];
    $password = $_POST['password'];

    if($username == '') {
    die("You must enter a username!");
    }
    if($password == '') {
    die("You must enter a password!");
    }
    // query
    $result = $conn->prepare("SELECT * FROM members WHERE username= :user AND password= :pass");
    $result->bindParam(':user', $username);
    $result->bindParam(':pass', $password);
    $result->execute();
    $rows = $result->fetch(PDO::FETCH_NUM);
    if($rows > 0) {
    echo "You are now logged in!";
    }
    else{
    echo "Login unsuccessful!";
    }

    ?>

[Mafugsa Bob]

PHP Code


<?php
$dbhost = "localhost";
$dbname = "membersdb";
$dbuser = "root";
$dbpass = "";

// database connection
$conn = new PDO("mysql:host=$dbhost;dbname=$dbname", $dbuser, $dbpass);

/*

If you give the submit <input> a name attribute you can simply do like I have done..

if (empty($_POST['username']) || empty($_POST['password']) || empty($_POST['password2']) || empty($_POST['email']))
{
    die("Error: All fields must be filled in!");
}
*/

if (!isset($_POST['submit']) || empty($_POST['submit']))
{
    die("Error: All field must be filled in!");
}
else
{

    /*
    $username  = htmlentities($_POST['username']);
    $password  = $_POST['password'];
    $password2 = $_POST['password2'];
    $email     = htmlentities($_POST['email']);

    Don't run htmlentities on data you've been submitted, run it when you output it instead.
    */

    $username  = $_POST['username'];
    $password  = $_POST['password'];
    $password2 = $_POST['password2'];
    $email       = $_POST['email'];

    if (filter_var($email, FILTER_VALIDATE_EMAIL) === false)
    {
        die("Error: E-mail address is not valid!");
    }

    if (strlen($username) > 15)
    {
        die("Username character limit exceeded!");
    }

    if (strlen($username) < 6)
    {
        die("Username must contain more than 5 characters!");
    }

    if (strlen($password) < 6)
    {
        die("Password must contain more than 5 characters!");
    }

    /*
    if (strlen($email) > 30)
    {
        die("Email character limit exceeded!");
    }

    your earlier filter_var should take care of the length (which is WAAAY more than just 30 (254 according to the standard))
    */

    /*
    //secure the password
    $salt      = '-45dfeHK/__yu349@-/klF21-1_\/4JkUP/4';
    $hashedpass  = sha1($salt . $password);
    $hashedpass2 = sha1($salt . $password2);

    More like UNSECURE the password (SHA1 shouldn't be used, the salt should always be random)! Upgrade to PHP >= 5.5!
    */

    $hashedpass = password_hash($password, PASSWORD_BCRYPT, [ "cost" => 12 ]);

    /*
    if ($hashedpass !== $hashedpass2)
    {
        die("Error: Passwords do not match!");
    }

    $hashpass will always be different, password_hash will generate a random salt, blah blah
    */

    if (!password_verify($password2, $hashpass))
    {
        die("Error: Password do not match!");
    }

    $stmt = $conn->prepare("SELECT username FROM members WHERE username = :name");
    $stmt->bindParam(':name', $username);
    $stmt->execute();

    if ($stmt->rowCount() > 0)
    {
        die("Username: $username already exists!");
    }

    $stmt = $conn->prepare("SELECT email FROM members WHERE email = :email");
    $stmt->bindParam(':email', $email);
    $stmt->execute();

    if ($stmt->rowCount() > 0)
    {
        die("Email: $email already exists in our database!");
    }

    else
    {

        //get data ready for db insert
        $sql = "INSERT INTO members (username, password, email) VALUES (:username, :password, :email)";
        //prepare statement
        $q   = $conn->prepare($sql);
        //execute statement, with variable data to placeholders
        $q->execute(array(
            ':username' => $username,
            ':password' => $hashedpass,
            ':email' => $email
        ));

        echo "Thank you for registering! <a href='login2.php'>Click here to login</a>";
    }
}

?>

<!DOCTYPE html>
<html>

<head>
<title>Registation page</title>
</head>

<body>
    <form method="POST">
        <input type="text" name="username"/><br />
        <input type="password" name="password"/><br />
        <input type="submit" name="submit"/>
    </form>
</body>
</html> 


I fixed it up a little and commented out some parts.

Can we see your database structure? Also, I would make the username and email field UNIQUE fields, that way there's no chance you'll have duplicates.

[La Manifesto]

Sure.
[img]http://#/ikXq8Y.jpg[/img]

---

I have a very simple login script now, that allows the user to login after registering. Its still in the basic stages and insecure, I want to have the theory working 100% before adding other features like sessions etc.

When I attempt to login with a registered username and password, it is telling me that it has been unsuccessful. However, when I go into my database and change the hashed password to plain text, and attempt the login again it is successful. So I think the hashing is the issue. Here is the four scripts, perhaps someone can see the issue.

Register form.

PHP Code


<?php 
<form action="checkregister.php" method="POST">
    Username<br>
    <input type="text" name="username" /><br>
    Password<br>
    <input type="password" name="password" /><br>
    Re-Enter Password<br>
    <input type="password" name="password2" /><br>
    Email<br>
    <input type="text" name="email" /><br>
    <input type="submit" value="Register" />
    </form> 


checkregister.php

PHP Code


<?php 
<!DOCTYPE html>
<html>

<head>
<title>Registation page</title>
</head>

<body>

<?php
$dbhost     = "localhost";
$dbname     = "mymembers";
$dbuser     = "root";
$dbpass     = "";

// database connection
$conn = new PDO("mysql:host=$dbhost;dbname=$dbname",$dbuser,$dbpass);

if (empty($_POST['username']) || empty($_POST['password']) || empty($_POST['password2']) || empty($_POST['email'] ))
  {
  die("Error: All fields must be filled in!");
  }

else
{

$username = htmlentities($_POST['username']);
$password = $_POST['password'];
$password2 = $_POST['password2'];
$email= htmlentities($_POST['email']);

if(!filter_var($email, FILTER_VALIDATE_EMAIL))
{
  die("Error: E-mail address is not valid!");
}

if (strlen($username)>15) {
die("Username character limit exceeded!");
}

if (strlen($username)<6) {
die("Username must contain more than 5 characters!");
}

if (strlen($password)<6) {
die("Password must contain more than 5 characters!");
}

if (strlen($email)>30) {
die("Email character limit exceeded!");
}

//secure the password
$salt = '-45dfeHK/__yu349@-/klF21-1_\/4JkUP/4';
$hashedpass = sha1($salt.$password);
$hashedpass2 = sha1($salt.$password2);

if($hashedpass !== $hashedpass2)
{
die("Error: Passwords do not match!");
}

//check if the username is already registered.
$stmt = $conn->prepare("SELECT COUNT(`username`) FROM members WHERE `username` = :name");
$stmt->execute(array(':name' => $username));

if ($stmt->fetch(PDO::FETCH_COLUMN) >= 1)
{
    die("Username: ".htmlentities($username)." already exists in our database!");
}

//check if the email is already registered.
$stmz = $conn->prepare("SELECT COUNT(`email`) FROM members WHERE `email` = :email");
$stmz->execute(array(':email' => $email));

if ($stmz->fetch(PDO::FETCH_COLUMN) >= 1)
{
    die("Email: ".htmlentities($email)." already exists in our database!");
}

//get data ready for db insert
$sql = "INSERT INTO members (username, password, email) VALUES (:username, :password, :email)";
//prepare statement
$q = $conn->prepare($sql);
//execute statement, with variable data to placeholders
$q->execute(array(':username'=>$username,':password'=>$hashedpass, ':email'=>$email));

echo "Thank you for registering ".htmlentities($username)."! <a href='login.php'>Click here to login</a>";

 }

?>

</body>
</html> 


loginform

PHP Code


<?php 
<form action="checklogin.php" method="POST">
    Username<br>
    <input type="text" name="username" /><br>
    Password<br>
    <input type="password" name="password" /><br>
    <input type="submit" value="Login" />
    </form> 


checklogin.php

PHP Code


<?php

    $dbhost     = "localhost";
    $dbname     = "mymembers";
    $dbuser     = "root";
    $dbpass     = "";

    // database connection
    $conn = new PDO("mysql:host=$dbhost;dbname=$dbname",$dbuser,$dbpass);

    $username = $_POST['username'];
    $password = $_POST['password'];

    if($username == '') {
    die("You must enter a username!");
    }
    if($password == '') {
    die("You must enter a password!");
    }
    // query
    $result = $conn->prepare("SELECT * FROM members WHERE username= :user AND password= :pass");
    $result->bindParam(':user', $username);
    $result->bindParam(':pass', $password);
    $result->execute();
    $rows = $result->fetch(PDO::FETCH_NUM);
    if($rows > 0) {
    echo "You are now logged in!";
    }
    else{
    echo "Login unsuccessful!";
    }

    ?>

Try changing the $row > 0 to count($rows) > 0.

[Idle cares]

Erm, you're not hashing the user entered password and trying to compare it to a hashed password, this will never work, never.

OP go install php 5.5+ and look at password_hash() and password_verify(). They automate the whole process and mean that you're not using already broken hashing algorithms and make sure you're not playing around with salts when you don't need to.

The creators of php have also said that they will continue to update the functions to use newer, more secure hashing methods when they come out.

The only reasons you wouldn't want to use them are:
1. You want to learn correct hashing/salt theory type stuff
2. You think that using something mainstream will make your code insecure if someone finds a vulnerability in the functions.
3. your hosting/OS doesn't support 5.5+

Which:
1. kudos, but make damn sure you're not using your tests in production code till you really know what you're doing.
2. You're more likely to code in venerabilities, but skepticism is good.
3. I believe there are methods to manually install the functions.

However, if you're still determined to use the code you have here, add this line of code to checklogin.php.

PHP Code


<?php 
//hash the password to compare to the hashed db value
$salt = '-45dfeHK/__yu349@-/klF21-1_\/4JkUP/4';
$hashedpass = sha1($salt.$password);

//and 
$result->bindParam(':pass', $hashedpass); 


Edit:
To then fix the issue Adherence has responded to, again you just need to use the same thing you did to make sure the registering member didn't have a duplicate email

PHP Code


<?php 
$result = $conn->prepare("SELECT COUNT(*) FROM members WHERE username= :user AND password= :pass");
$result->bindParam(':user', $username);
$result->bindParam(':pass', $hashedpass);
$result->execute();
$rows = $result->fetchColumn();
if ($rows > 0)
{
    echo "You are now logged in!";
}
else
{
    echo "Login unsuccessful!";
} 


FETCH_NUM sets the return to a numeric array, meaning that it would look something like

PHP Code


<?php 
array(0 => 1, 1 => "[email protected]", 2 => "dave", 3 => "dsfglvjhsdf809u3546tlkj") 


fetchColumn() returns the value of the very first column queried, and as we have changed that to a count() it will be the number of rows where the user and pass match.

[VipVince]

Thanks for all the constructive and informative posts.

I definitely have learned a thing or two, I initially just wanted to get the whole concept working, which I now have. Now I will take the advice given and make my current code better, and improved following the advice given. I guess the best way of learning is through trial and error, fixing and improving.

[Mafugsa Bob]

Thanks for all the constructive and informative posts.

I definitely have learned a thing or two, I initially just wanted to get the whole concept working, which I now have. Now I will take the advice given and make my current code better, and improved following the advice given. I guess the best way of learning is through trial and error, fixing and improving.

Post whatever code you're using now so we can judge you and tell you how bad you are.

Spoiler (Click to View)
obviously I was joking about the last part

[VipVince]

Post whatever code you're using now so we can judge you and tell you how bad you are.

Spoiler (Click to View)
obviously I was joking about the last part

I stopped for today, my concentration after several hours is not the same and my eyes don't interpret the code the same way. Will continue on this in the morning, and will post the code for examination!

[So...]

If you are planning on continuing and further expanding your knowledge into a professional based environment, I would highly recommend learning a PHP Framework, such as Codeigniter

Only downside is you won't learn the entry level concepts such as database's and securing forms/user inputs, all this is already built in, you do however dive straight into the more complicated areas