0

I'm working on a project which is a user, admin dashboard . first I have a page where is tell user/admin to signup in that i have email, passowrd, cpassword, department, schemes (both are select option field) and designation(like, collector, SdM, ETC) ,and role(user, admin). now then user/admin signup its detail fill in database and then he go to login page and write its email and password and he redirected to login page where also department and schemes select option field . my question is that what should be logic that when a user/admin signup , the details which he enter and select from select filed that should be displayed to index page . like he select department(education and its scheme ) so that scheme only display on index page no other department and scheme i said again my signin and index page is same like 10department and there 50 schemes each of them. user select and he only see on index page that is fill in signin page

just tell me logic thankyou code signin.php

if($_SERVER["REQUEST_METHOD"] == "POST"){
// Connection Established
  $server = "localhost";
  $username = "root";
  $password = "";
  $database = "registration";  

   $conn = mysqli_connect($server, $username, $password, $database);
   if (!$conn){
//     echo "success";
// }
// else{
    die("Error". mysqli_connect_error());
  }
        $Email = $_POST["Email"];
        $password = $_POST["password"];
        $cpassword = $_POST["cpassword"];
        $department = $_POST["department"];
        $schemes = $_POST["schemes"];
        $designation = $_POST["designation"];
        $Role = $_POST["Role"];

         //   $exists=false;

    $existSql = "SELECT * FROM `usertable` WHERE Email = '$Email'";
    $result = mysqli_query($conn, $existSql);

    mysqli_set_charset($conn,'utf8'); // for hindi font language issue

    $numExistRows = mysqli_num_rows($result);
    if($numExistRows > 0){
        // $exists = true;
        $showError = "Email Already Exists";
     }     
     
    else{
        // $exists = false; 
        if(($password == $cpassword)){
            $hash = password_hash($password, PASSWORD_DEFAULT);
            $sql = "INSERT INTO `usertable` (`Email`,`password`,`department`,`schemes`,`designation`,`Role`, `dt`) VALUES ('$Email', '$hash','$department','$schemes','$designation','$Role', current_timestamp())";

            $result = mysqli_query($conn, $sql);
            if ($result){
                $showAlert = true;
            }
        } 
        else{
            $showError = "Passwords do not match";
        }      
    }
}
  // login.php

<?php

  $login = false;
  $showError = false;
// db Connection
 if($_SERVER["REQUEST_METHOD"] == "POST"){

   $server = "localhost";
   $username = "root";
   $password = "";
   $database = "Registration";

   $conn = mysqli_connect($server, $username, $password, $database);
   if (!$conn){
 //     echo "success";
 // }             
 // else{
    die("Error". mysqli_connect_error());
  }
    $Email = $_POST["Email"];
    $password = $_POST["password"];      

   // $sql = "Select * from users where username='$username' AND password='$password'";
    $sql = "Select * from usertable where Email='$Email'"; 

    $result = mysqli_query($conn, $sql);
  
    $num = mysqli_num_rows($result);  
   

    if ($num == 1){

        while($row = mysqli_fetch_assoc($result)){

            if (password_verify($password, $row['password'])){ 
                $login = true;
                session_start();

                $_SESSION['loggedin'] = true;
                $_SESSION['Email'] = $Email;              

                header("location: index.php");
            } 
            else{
                $showError = "Invalid Email";
            }
        }        
    } 
    else{
        $showError = "Invalid Email Or Password";
    }
}
    
?> 
  • **Warning!** You're open to [SQL injection attacks](https://owasp.org/www-community/attacks/SQL_Injection)! Read [how to prevent SQL injection in PHP](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) by using prepared statements with bound parameters instead of injecting variables directly into your queries. It's not just about security. If your data contains, for example, a single quote `'`, your query will break. – M. Eriksson May 04 '22 at 06:41

0 Answers0