0

I have problem with my login page where it keep showing the alert wrong username/password combination when I try to login but there is no error shown. I have read other stackoverflow questions but still don't understand what is the problem.

Here is my code

if (isset($_POST['login_user'])) {
  $username = $_POST['username'];
  $password = $_POST['password'];

    $query = "SELECT * FROM student WHERE stud_id='$username' AND stud_password='$password'";
    $results = oci_parse($db, $query);

    oci_execute($results);
    if (oci_num_rows($results) == 1) {

      $row = oci_fetch_assoc($results);

      $_SESSION['fullname'] = $row['stud_name'];
      $_SESSION['username'] = $username;
      //header('location: adminDash.php');

      echo
            (
                "<SCRIPT LANGUAGE='JavaScript'>
                window.alert('Login Succesfull!')
                window.location.href='testing.php'
                </SCRIPT>"
            );
    }
    else {
      echo
            (
                "<SCRIPT LANGUAGE='JavaScript'>
                window.alert('Wrong username/password combination!')
                </SCRIPT>"
            );
    }
}
6
  • First problem. You are using user input directly without sanitizing it. This leaves you open to an sql injection attack. Second. I would assume your passwords are in the db in some encrypted format. You are passing in a plaintext password. May 15, 2018 at 13:46
  • @Rashid'Lee'Ibrahim my password are not encrypted
    – Rhya
    May 15, 2018 at 13:58
  • @nabella they really should be! phpbestpractices.org/#passwords
    – JeffUK
    May 15, 2018 at 14:36
  • That is a huge security flaw. Not only because internally anyone can look up any user's password. But if your db is ever compromised (like with that sql injection you are open to or any reason) then all the passwords are compromised. As for the actual problem. Try running the sql manually against the db and see if you get the response you expected.. May 15, 2018 at 14:37
  • if I change the if (oci_num_rows($results) == 1) to if (oci_num_rows($results) == 0) then it shows login successful which means the query doesn't return the number of row that have in my table. Currently my table have 2 rows of data. about the security flaw, I will correct it once I solve this main problem.
    – Rhya
    May 15, 2018 at 14:54

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.