log in system with sessions and mysqli done something wrong - php

Question

Hello guys I am trying to make a simple log-in system for a school project, I got it to work when I didn't implement the database. But as you can see now that I tried to implement the database it don't work so well since I can't make the PHP tags at the start and end of the echo's, anyway anyone who can help me out?
As I said it worked when I just wrote a random username and password, and didn't have any database thing on it.
<?php
session_start();
include('../inc/dbconnection_inc.php');
$result=mysqli_query($dbconnection, 'SELECT * FROM users');
$row=mysqli_fetch_array($result);
$p=$_POST['password'];
$u=$_POST['username'];
if ($u==echo $row["username"] AND $p==echo $row["password"]);
{
$_SESSION['username'] = echo $row["username"];
header("Location: admin.php");
}
else
{
header("Location: ../index.php");
}

Answer 1

I am not sure that you need echo there. According to the manual, echo returns nothing.
Try removing all echo's from the code, like
...
if ($u === $row["username"] && $p === $row["password"])
{
$_SESSION['username'] = $row["username"];
header("Location: admin.php");
}
(also I usually use && instead of AND, that also could be the cause)
Besides your code will check only first fetched row (I think you're aware of that?)

Answer 2

$p=$_POST['password'];
$u=$_POST['username'];
$query = 'SELECT * FROM users WHERE username = ?';
if($result=mysqli_query($dbconnection, $query)){
mysqli_stmt_bind_param($result, "s", $u);
mysqli_stmt_execute($result);
$row=mysqli_fetch_array($result);
if ($u == $row["username"] && $p == $row["password"]);
{
$_SESSION['username'] = echo $row["username"];
header("Location: admin.php");
}
else
{
header("Location: ../index.php");
}
}else{
//fail
}
Remove the echo
Select a specific user by adding a Where Clasuse
Prepare your statment