REST Api can't read my request - php

Question

I'm using slim for my framework and whenever I test it on Postman the the php cant read the parameters but when i convert it to md5 the php now can read the request. What could be my problem. The server is sending me null. Here is my code
DBOperations.php
//Method for user login
function userLogin($userName, $userPassword)
{
$password = md5($userPassword);
$stmt = $this->con->prepare("SELECT userID FROM users WHERE userName = ? AND userPassword = ?");
$stmt->bind_param("ss", $userName, $password);
$stmt->execute();
$stmt->store_result();
return $stmt->num_rows > 0;
}
index.php
//user login route
$app->post('/login', function (Request $request, Response $response) {
if (isTheseParametersAvailable(array('userName', 'userPassword'))) {
$requestData = $request->getParsedBody();
$userName = $requestData['userName'];
$userPassword = $requestData['userPassword'];
$password = md5($userPassword);
$db = new DbOperation();
$responseData = array();
if ($db->userLogin($userName, $userPassword)) {
$responseData['error'] = false;
$responseData['username'] = $db->getByUserName($userName);
} else {
$responseData['error'] = true;
$responseData['message'] = $password;
}
$response->getBody()->write(json_encode($responseData));
}
});
When the password is md5
{"error":true,"message":"d41d8cd98f00b204e9800998ecf8427e"}
When the password is not
{"error":true,"message":null}

Answer 1

You should do something like this
function userLogin($userName, $userPassword)
{
$stmt = $this->con->prepare("SELECT userID, password FROM users WHERE userName = ?");
$stmt->bind_param("s", $userName);
$stmt->execute();
$stmt->store_result();
$stmt->bind_result( $userID , $password);
$result = $stmt->fetch();
if( password_verify($userPassword, $password)){
return true;
}
return false;
}
I don't use Mysqli, so I hope I got that part right.
The important thing is that you should not use the password as part of the WHERE clause. There are several reasons for this
your relying on getting a result instead of checking the result against input data. If there is a problem with your query it could allow logins when it shouldn't
your not checking the password using a secure method designed for doing it.
Etc.
You should use
password_hash
And
password_verify