Check if is email and password correct [closed] - php

Question

Closed. This question needs debugging details. It is not currently accepting answers.
Edit the question to include desired behavior, a specific problem or error, and the shortest code necessary to reproduce the problem. This will help others answer the question.
Closed 8 years ago.
Improve this question
I need to confirm if is email and password correct , but it work with any password I enter. What's the problem? Here is the code:
<?php
if(isset($_POST['submit'])){
$email = mysql_real_escape_string($_POST['email']);
$pass = $_POST['password'];
$hash = hash("sha512", $pass);
$hash1 = hash("whirpool", $hash);
$hash2 = hash("sha384", $hash1);
$password = $hash2;
$query=mysql_query("SELECT * FROM register WHERE email='$email' AND password='$password'") or die(mysql_error());
$count=mysql_num_rows($query);
if($count==1){
while ($row=mysql_fetch_array($query)) {
$username=$row['username'];
$heslo=$row['password'];
$_SESSION['valid'] = $username;
if(isset($_SESSION['valid'])){
$realtime = date("d-m-Y h:i:s");
$session = $_SESSION['valid'];
echo "<script> window.location.replace('index.php');
</script>";
header("Location: index.php");
}else{
echo "Přihlášení neproběhlo správně";
}
}
}
}
?>

Answer 1

The problem you're facing is that you mispelled "whirpool" it should be "whirlpool"

Answer 2

I have changed the code a bit, and this seems to be working. The curly brackets order is the one messing it up for you, as the else points to the incorrect if.
I have added comments throughout the script, so you can see what I'm trying to say.
mysql_connect('localhost','user','pass');
mysql_select_db('test');
# You can use your post methods, I've used these for testing.
$email = mysql_real_escape_string('email');
$pass = $_GET['pw'];
$hash = hash("sha512", $pass);
$hash1 = hash("whirlpool", $hash);
$hash2 = hash("sha384", $hash1);
$pass = $hash2;
# Now you can see the PW input
echo $pass."<br>";
# Nonsense
$password = $pass;
# By using $sql you can echo your query to see what results would it yield upon running it.
$sql = "SELECT * FROM test WHERE em='$email' AND pw='$password'";
$query=mysql_query($sql) or die(mysql_error());
$count=mysql_num_rows($query);
# Echo stuff to see what their results are
echo $sql."<br>";
echo $count."<br>";
# Let's see if we all got it right?
if($count==1){
while ($row=mysql_fetch_array($query)) {
$username=$row['un'];
$heslo=$row['pw'];
$_SESSION['valid'] = $username;
if(isset($_SESSION['valid'])){
$realtime = date("d-m-Y h:i:s");
$session = $_SESSION['valid'];
# Commented out for testing purposes. I mean the header.
echo "all is well";
//header("Location: index.php");
} // this closes the if(isset...
} // this closes the while loop
# Note that the curly brackets have changed. Now the else points correctly to the other branch if $count is not equal to 1.
} else {
echo "Přihlášení neproběhlo správně";
}