-2

I have an error with my PHP code. This statement header("Location: /pluto_project/index.php?error=nouser"); in my else statement always get executed.

I'm just a newbie in PHP and I don't have a vast knowledge about everything. Please help me. Thanks a lot.

<?php
    
if(isset($_POST['submit']))
{
    require 'database_handler.inc.php';

    $user_name = $_POST['name'];
    $password = $_POST['password'];

    if(empty($user_name) || empty($password) ) {
        header("Location: /pluto_project/index.php?error=emptyFields&username=".$user_name);
        exit();
    }
    else{
        $sql = "SELECT * FROM users WHERE username=?";
        $statement = mysqli_stmt_init($connection);

        if(!mysqli_stmt_prepare($statement, $sql)){
            header("Location: /pluto_project/index.php?error=sqlError");
            exit();
        }
        else{
            mysqli_stmt_bind_param($statement, "s", $username);
            mysqli_stmt_execute($statement);

            $result = mysqli_stmt_get_result($statement);

            if($row = mysqli_fetch_assoc($result) ){
                $password_check = password_verify($password, $row['upassword']);
                
                if(!$password_check){
                    header("Location: /pluto_project/index.php?error=wrongpassword");
                    exit();
                }
                else if($password_check){
                    session_start();
                    $_SESSION['userID'] = $row['id_user'];
                    $_SESSION['userName'] = $row['username'];
                    
                    header("Location: /pluto_project/index.php?login=success");
                    exit();
                        
                }
                else{
                    header("Location: /pluto_project/index.php?error=sqlError");
                    exit();
                }
            }
            else{
                header("Location: /pluto_project/index.php?error=nouser");
                exit();
            }
        }
    }
}
else{
    header("Location: /pluto_project/index.php");
    exit();
}
5
  • I believe it's because $row = mysqli_fetch_assoc($result) always return something that PHP evaluated to false. I recommend you move the $row = mysqli_fetch_assoc($result) outside of the if statement condition and use var_dump() to see its content. Something like $row = mysqli_fetch_assoc($result); var_dump($row); /* Your if statement */ Jul 15, 2020 at 9:46
  • Thanks, @theminer3746 but I've already solved the error (thanks for @Amacado) but right now I have a new one lol. Jul 15, 2020 at 9:54
  • Your code is very if/else nested at too many levels. It is only increasing indenting with no reason and make the code unreadable. There is no reason to add else when if block does return, break, continue, exit, throw. Jul 15, 2020 at 9:58
  • 3
    You need to stop manually checking for errors. Please read: Should we ever check for mysqli_connect() errors manually? and Should I manually check for errors when calling “mysqli_stmt_prepare”?
    – Dharman
    Jul 15, 2020 at 10:19
  • 1
    Thanks guys @armagedescu, and dharman Jul 16, 2020 at 4:21

1 Answer 1

0

You are using an undefined variable in your sql statement. In your binding you refer to $username but in your variable definition you define $user_name.

// wrong code
$user_name = $_POST['name'];
mysqli_stmt_bind_param($statement, "s", $username);

// fixed code
$user_name = $_POST['name'];
mysqli_stmt_bind_param($statement, "s", $user_name);

Try changing the statement/variable to match your declaration.

1
  • Oops sorry. But I still get an error about the wrong password, but I'm really sure I typed the correct password Jul 15, 2020 at 9:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.