How do you fix my multi-user login system

Question

Hello I have been encountering this bug for a long time. So basically here is by code:

function loginUser($conn, $username, $password) {
    $checkExists = checkExists($conn, $username, $username);

    if ($checkExists === false) {
        header("Location: ../login.php?error=wronglogininfo");
        exit();
    }

    $passwordHashed = $checkExists['password'];
    $checkPassword = password_verify($password, $passwordHashed);

    if ($checkPassword === false) {
        header("Location: ../login.php?error=wronglogin");
        exit();
    } elseif ($checkPassword === true) {
        $query = "SELECT * FROM users WHERE username='$username' AND password='$checkPassword'";
        $query_run = mysqli_query($conn, $query);
        $usertypes = mysqli_fetch_array($query_run);

        if ($usertypes['usertype'] == "admin") {
            header('Location: ../login.php?admin');
        } elseif ($usertypes['usertype'] == "user") {
            header('Location: ../login.php?user');
        }
    }
}

function checkExists($conn, $username, $email) {
    $sql = "SELECT * FROM users WHERE username = ? OR email = ?;";
    $stmt = mysqli_stmt_init($conn);

    if (!mysqli_stmt_prepare($stmt, $sql)) {
        header("Location: ../register.php?error=stmtfailed");
        exit();
    } 

    mysqli_stmt_bind_param($stmt, "ss", $username, $email);
    mysqli_stmt_execute($stmt);

    $resultData = mysqli_stmt_get_result($stmt);

    if ($row = mysqli_fetch_assoc($resultData)) {
        return $row;
    } else {
        $result = false;
        return $result;
    }
    
    mysqli_stmt_close($stmt);
}

And so the errors work fine. The real problem is that whenever I login with correct credentials it sends me to a 404 page with a directory I never put. I want it to send be to the admin panel or user page. Can anyone help?

Answer 1

This select looks like a road to ruin: SELECT * FROM users WHERE username='$username' AND password='$checkPassword' If $checkPassword is the result of a password_verify(). (Also be careful about possible SQL injection.)

I suspect this is your main issue. This would essentially translate your query to:

SELECT * FROM users WHERE username = 'tony' AND password = '1';

This will likely return an empty result set, but your very next if statement is expecting a user array populated with data.

if ($usertypes['usertype'] == "admin") {
    header('Location: ../login.php?admin');
} elseif ($usertypes['usertype'] == "user") {
    header('Location: ../login.php?user');
}

What happens now? You won't be redirected anywhere and the current script will continue processing. So what can you do?

If you already have the user row, via checkExists() (could this be named better?), why do another call to the database to get the usertype?

You already have access to your user array because you called checkExists above and verified it is not false. Just use the array directly.

I just cleaned up your code a bit and added in some comments. I did not alter your queries in any way and didn't verify they are correct.

function loginUser($conn, $username, $password) {

    // Renamed this variable
    // Validate it and use this variable for the remainder of the function.
    $user = checkExists($conn, $username, $username);

    if ($user === false) {
        header("Location: ../login.php?error=wronglogininfo");
        exit();
    }

    $passwordHashed = $user['password'];

    // Renamed this variable.
    $validPassword = password_verify($password, $passwordHashed);

    if ($validPassword === false) {
        header("Location: ../login.php?error=wronglogin");
        exit();
    }
    
    // You now know you have a user and a valid password. 
    // No need to select them again

    if ($user['usertype'] == "admin") {
        header('Location: ../login.php?admin');
        exit;
    } 

    if ($user['usertype'] == "user") {
        header('Location: ../login.php?user');
        exit;
    }

    // What happens if `usertype` not matched? You still need to handle this case?
}

function checkExists($conn, $username, $email) {
    $sql = "SELECT * FROM users WHERE username = ? OR email = ?;";
    $stmt = mysqli_stmt_init($conn);

    if (!mysqli_stmt_prepare($stmt, $sql)) {
        header("Location: ../register.php?error=stmtfailed");
        exit();
    } 

    mysqli_stmt_bind_param($stmt, "ss", $username, $email);
    mysqli_stmt_execute($stmt);

    $resultData = mysqli_stmt_get_result($stmt);

    // Cleaned up this if statement
    if ($row = mysqli_fetch_assoc($resultData)) {
        return $row;
    }
   
    return false;   
}