0

I have a simple login form that sends user to the page below, after the user enters their username and password. This page verifies that the username and password are correct and then sends them into the site. This all works except for the part where I try and store the "userid" in a session. I want to store the user ID so that I can run queries and populate the rest of the site with the user's associated information. As you can probably tell, I'm still super new to this, so any help would be appreciated.

<?php 
session_start();

if($_SERVER['REQUEST_METHOD']=='POST'){

    try{
        $con = new PDO('mysql:host=localhost;dbname=DBNAME','USERNAME','PASSWORD');
        $con->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
        $con->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
    }catch (Exception $e){
        die('Cannot connect to database. Details:'.$e->getMessage());
    }
    $query = $con->prepare("SELECT 1 FROM userprofile WHERE username=:username && password=:password");

    $query->bindParam(":username", $_POST['myusername']);
    $query->bindParam(":password", $_POST['mypassword']);
    $query->execute();

    $result = $query->fetchAll(PDO::FETCH_ASSOC);

    if(!empty($result)){
        $_SESSION['loggedin']=1;
        $_SESSION['myusername']=$_POST['myusername'];
        $_SESSION['userid'] = ("SELECT id FROM userprofile WHERE username=:username && password=:password");

        exit(header('Location: index.php'));
    }else{
        exit(header('Location: login.php'));
    }

}else{
    exit(header('Location: login.php'));
}
?>

Another quick question: Is it safe to have my databases name, my username, and password stored on this page? Even though this is just a page that talks with the server and is never shown, can someone gain access to this information and log into my database?

3 Answers 3

1

What is the problem, is the session not being stored? Try echoing out $_SESSION['myusername'] for example, or using Firebug to see which value, if any is being stored.

1

You're attempting to assign a value to a session variable directly from the results of your query. You can't do that because running your query returns an array, not a simple string.

Try this:

print_r($result);

You should see an array of the values your query returned, and THEN you can find the one you're looking for and assign it to the session variable.

0

You should just grab the user information in the first query instead of using a second one or storing a query for it in the session:

$query = $con->prepare("SELECT id FROM userprofile WHERE username=:username AND password=:password LIMIT 1");

$query->bindParam(":username", $_POST['myusername']);
$query->bindParam(":password", $_POST['mypassword']);
$query->execute();

$result = $query->fetch(PDO::FETCH_ASSOC);
$query->closeCursor();

if(!empty($result)){
    $_SESSION['loggedin']=1;
    $_SESSION['myusername']=$_POST['myusername'];
    $_SESSION['userid'] = $result['id'];

    exit(header('Location: index.php'));
}else{
    exit(header('Location: login.php'));
}

Additionally the code you posted would lead me to believe you are storing your passwords directly in the database. You shouldnt be doing this, you should be hashing them with a salt instead and comparing the hashes for login.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.