0

So I started learning PHP and MySQL.I want to create several quizzes with registration,login etc.So far the registration works like a charm.Every registred user is stored in my database.The login thou'....doesn't work.Everytime I try to login I get redirected to a blank page.Ignore those silly echoes...just checking out if it works or not.I can't solve this...no matter what I do(srry for my english).Any help?
Here is the PDO version that I did after you guys told me to use it. 

   <?php
 session_start();
$servername="localhost";
$user="root";
$pass="";
$dbname="test";


$conn=new PDO("mysql:host=$servername;dbname=$dbname",$user,$pass);
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

if(isset($_POST['submit']))
{
    $username=trim($_POST['User']);
    $password=trim($_POST['Password']);

$log=$conn->prepare('SELECT User,Password FROM Account WHERE User=:User');
$log->bindParam(':User',$username);
$log->execute();
$result=$log->fetch(PDO::FETCH_ASSOC);
if(count($result)>0 && password_verify($password,$result['Password']))
{
    $_SESSION['User']=$result['User'];
    header("location:welcome.php");
    exit();
}  
else {
    echo "Wrong details";
}
}


?>
  • 3
    Backticks are for columns/tables, quotes are for stings. Passwords should be hashed, and you should use parameterized queries with an updated driver. – chris85 Jul 01 '16 at 17:10
  • @chris85 just a note, mysqli was used for the connection ^^ – FirstOne Jul 01 '16 at 17:11
  • 1
    **Never store plain text passwords!** Please use PHP's [built-in functions](http://jayblanchard.net/proper_password_hashing_with_PHP.html) to handle password security. If you're using a PHP version less than 5.5 you can use the `password_hash()` [compatibility pack](https://github.com/ircmaxell/password_compat). Make sure you ***[don't escape passwords](http://stackoverflow.com/q/36628418/1011527)*** or use any other cleansing mechanism on them before hashing. Doing so *changes* the password and causes unnecessary additional coding. – Jay Blanchard Jul 01 '16 at 17:12
  • 1
    @FirstOne then there are 2 issues. `mysql_query($query)`, `mysql_real_escape_string`, `mysql_num_rows`. – chris85 Jul 01 '16 at 17:12
  • 1
    Please [stop using `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php). [These extensions](http://php.net/manual/en/migration70.removed-exts-sapis.php) have been removed in PHP 7. Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [PDO](http://php.net/manual/en/pdo.prepared-statements.php) and [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and consider using PDO, [it's really pretty easy](http://jayblanchard.net/demystifying_php_pdo.html). – Jay Blanchard Jul 01 '16 at 17:12
  • 1
    You are using `mysqli_connect` for the connection and then `mysql_*` functions. Please, take a look at [**Can I mix MySQL APIs in PHP?**](http://stackoverflow.com/questions/17498216/can-i-mix-mysql-apis-in-php) – FirstOne Jul 01 '16 at 17:12
  • 1
    [Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)***. Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! – Jay Blanchard Jul 01 '16 at 17:12
  • 1
    There is more than two issues @chris85 ¯\\_(ツ)_/¯ – Jay Blanchard Jul 01 '16 at 17:14
  • 1
    @JayBlanchard True, well there's at least a list of things for the OP to look into here. OP, you should check your error logs also, that will give you useful information about the current reason your code is failing. http://stackoverflow.com/questions/845021/how-to-get-useful-error-messages-in-php – chris85 Jul 01 '16 at 17:17
  • I guess I'll just start all over.Crap. –  Jul 01 '16 at 17:25
  • So...I edited the code...using PDO and I still get the blank page thing.At this point I really have no idea what to do anymore. –  Jul 02 '16 at 11:30

0 Answers0