PHP MySQL Table, Using to log into account in the table - php

Question

I have got a MySQL Table named 'MainData' and i have 3 columns 'username', 'email' and 'pass'. I have a snipped of my code, it all works except when i try to convert the users $_POST input into an md5 hash. When i leave the md5 encryption's off and all of the passwords are visible in the database it works but when i use md5 it doesnt work and just echo's 'Sorry, the username or password was incorrect.'
Here is the snipped of my code:
<?php
$servername = "localhost";
$username = "avxtechn_benph64";
$password = "admin123";
$dbname = "avxtechn_users";
$dbtable = "MainData";
// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$usr = $_POST["user"];
$psr = $_POST["password"];
$sql = "SELECT username, pass FROM " . $dbtable;
$result = $conn->query($sql);
$nameCount = 0;
$UserName = 0;
if ($result->num_rows > 0) {
// output data of each row
while($row = $result->fetch_assoc()) {
if ( $usr == $row["username"] && md5($psr) == $row["pass"]) {
$nameCount = $nameCount + 1;
$UserName = $usr;
}
}
} else {
echo "nil";
}
if ($nameCount > 0) {
echo ' Welcome back, ' . $UserName;
}else{
echo 'Sorry, that username or password was incorrect.';
}
$conn->close();
?>
This is the full code.
Here is the PHPMyAdmin database:

Answer 1

I guess that your problem is you stored passwords in your database before as a plain text.
So to get your authentification work now you should:
if ( $usr == $row["username"] && $psr == $row["pass"]) {
or
if ( $usr == $row["username"] && (md5($psr)) == md5($row["pass"])) {
but the best way is to convert your data (make backup first for sure) by running this query:
UPDATE MainData SET pass = MD5(pass)
then your code can start to work. but check the pass type before converting to assure that it can hold larger strings.

Answer 2

I would strongly recommend to change your code.
Use the following SQL code:
$result = $conn->query('SELECT count(*) as nr WHERE username = ' . $username . ' AND pass = MD5('. $password .'));
You should have an integer of 1 in "nr" if the login is valid.
Make Mysql do a single count of the usernames having that user/password combination.
Also MySQL is able to do the MD5 method for you.
( Instead of looping all the results in your resultset. )
EDIT:
Please sanitize your input before adding it into queries.