PHP: Session based login script won't work

Question

I got a simple login script that post the password and check the corrispondence with the database

session_start();
include 'core/config.php';
include 'core/db.php';
$checkPWD = $DB_CON -> query('SELECT * FROM users');
$checkPWD->execute();
$pwd = $checkPWD->fetchAll();
if($_POST['password']) {
    $md5pwd = md5($_POST['password']);
    if($md5pwd == $pwd[2]) {
         $_SESSION['login'] = 'true';
         $_GET['page'] = 'dashboard';
    } else {
        $_GET['error'] = 'true';
    }
}

This exit and got $_GET['error'] set to true. The password is stored in md5 in database.

Thanks a lot

the script exit to the else and get $_GET['error'] = 'true' even if the password is correct — andreaem, May 03 '16 at 12:28
This script is a hot mess. You're selecting the entire users table? And then you MD5 the password (which is [NOT SECURE](http://security.stackexchange.com/questions/52461/how-weak-is-md5-as-a-password-hashing-function)). There's no loop for your data either. [Consider switching to password_hash](http://stackoverflow.com/questions/14992367/using-php-5-5s-password-hash-and-verify-function-am-i-doing-it-right) — Machavity, May 03 '16 at 12:33
@Machavity thanks for your suggestion, can you provide a working example? EDIT: the script is running in a Local VPS accessible only via VPN connection, password auth is only for locking idle sessions — andreaem, May 03 '16 at 12:35

Grommy · Accepted Answer · 2016-05-03T13:07:38.163

1

You should do it in you query:

$md5pwd = md5($_POST['password']);

$checkPWD = $DB_CON->query("SELECT * FROM users WHERE password = '{$md5pwd}' LIMIT 1");
$pwd = $checkPWD->fetchAll();

if ($pwd) {
     // Has find someone
} else {
     // Hasn't find no one
}

edited May 03 '16 at 13:07

answered May 03 '16 at 12:30

Grommy

367
1
8

Changed the code, but the result is the same, it don't store any session value – andreaem May 03 '16 at 12:35
He's selecting the whole users table. So if this doesn't match the first record you're out of luck – Machavity May 03 '16 at 12:38
I changed it, just I thought he knows that the second row was the correct – Grommy May 03 '16 at 12:43
Thanks it's working! – andreaem May 03 '16 at 15:46

PHP: Session based login script won't work

1 Answers1