Having problems with PHP [closed] - php

Question

Closed. This question needs debugging details. It is not currently accepting answers.
Edit the question to include desired behavior, a specific problem or error, and the shortest code necessary to reproduce the problem. This will help others answer the question.
Closed 7 years ago.
Improve this question
My PHP code won't verify the data to the database, it keeps returning saying Invalid login data, even though the data is correct.
This problem occurred after I switched over from using MySQL (which worked fine) to mysqli to be more secure.
The connection file data is sound, so I have no idea why the code keeps saying invalid login data.
session_start();
include_once("connect.php");
if (isset($_POST['username'])) {
$username = $_POST['username'];
$password = $_POST['password'];
$stmt = $mysqli->prepare("SELECT * FROM users WHERE username=?
AND password=? LIMIT 1");
$stmt->bind_param('ss', $username, $password);
$stmt->execute();
$stmt->fetch();
$res = $mysqli->query($stmt);
if (mysqli_num_rows($res) == 1) {
$row = $res->fetch_assoc();
$_SESSION['uid'] = $row['id'];
$_SESSION['username'] = $row['username'];
header("Location: forum.php");
exit();
} else{
echo "Invalid login information. Please return to previous page.";
exit();
}
}
Thank you.

Answer 1

The query and execute functions both execute your query. The query doesn't work with prepared statements.
Try:
$stmt = $mysqli->prepare("SELECT * FROM users WHERE username=?
AND password=? LIMIT 1");
$stmt->bind_param('ss', $username, $password);
$stmt->execute();
$stmt->store_result();
if ($stmt->num_rows == 1) {
$row = $stmt->fetch_assoc();
$_SESSION['uid'] = $row['id'];
$_SESSION['username'] = $row['username'];
header("Location: forum.php");
exit();
} else{
echo "Invalid login information. Please return to previous page.";
exit();
}
It also is unclear if you are hashing already or not but user passwords should be hashed.
Also rather than telling the user to return to the previous page you could pass a parameter in a header function that displays the message for the user.
Something like:
header('location: http://domain.com/page.php?message=Your+username+or+password+were+incorrect+please+try+again');
in place of
echo "Invalid login information. Please return to previous page.";
and then on previous page check $_GET['message'].