I have problem with my login page where it keep showing the alert wrong username/password combination when I try to login but there is no error shown. I have read other stackoverflow questions but still don't understand what is the problem.
Here is my code
if (isset($_POST['login_user'])) {
$username = $_POST['username'];
$password = $_POST['password'];
$query = "SELECT * FROM student WHERE stud_id='$username' AND stud_password='$password'";
$results = oci_parse($db, $query);
oci_execute($results);
if (oci_num_rows($results) == 1) {
$row = oci_fetch_assoc($results);
$_SESSION['fullname'] = $row['stud_name'];
$_SESSION['username'] = $username;
//header('location: adminDash.php');
echo
(
"<SCRIPT LANGUAGE='JavaScript'>
window.alert('Login Succesfull!')
window.location.href='testing.php'
</SCRIPT>"
);
}
else {
echo
(
"<SCRIPT LANGUAGE='JavaScript'>
window.alert('Wrong username/password combination!')
</SCRIPT>"
);
}
}
if (oci_num_rows($results) == 1)
toif (oci_num_rows($results) == 0)
then it shows login successful which means the query doesn't return the number of row that have in my table. Currently my table have 2 rows of data. about the security flaw, I will correct it once I solve this main problem.