-2

The question I am asking has been asked here but was asked pretty badly and resulted in the problem not being resolved: Notice: Undefined variable: mysqli in C:\xampp\htdocs\template\login.php on line 67

Warning: mysqli_query() expects parameter 1 to be mysqli, null given in C:\xampp\htdocs\template\login.php on line 67

Warning: mysqli_fetch_assoc() expects parameter 1 to be mysqli_result, null given in C:\xampp\htdocs\template\login.php on line 71

Warning: mysqli_num_rows() expects parameter 1 to be mysqli_result, null given in C:\xampp\htdocs\template\login.php on line 74

My Query:

public function login_admin($email,$pass){

    $cek = mysqli_query($mysqli, "SELECT * FROM admin WHERE email='$email' AND password='$pass'");

    $data = mysqli_fetch_assoc($cek);
    $cocokan = mysqli_num_rows($cek);
    
    if ($cocokan > 0) {
        //bisa login
        $_SESSION['login_admin']['id'] = $data['kd_admin'];
        $_SESSION['login_admin']['email'] = $data['email'];
        $_SESSION['login_admin']['nama'] = $data['nama'];
        $_SESSION['login_admin']['gambar'] = $data['gambar'];

        return true;
    }
    else{
        return false;
    }
}
Barmar
  • 669,327
  • 51
  • 454
  • 560
steven chandra
  • 1
  • 1
    **Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/32391315) – Dharman May 24 '22 at 14:38
  • 1
    **Never store passwords in clear text or using MD5/SHA1!** Only store password hashes created using PHP's [`password_hash()`](https://php.net/manual/en/function.password-hash.php), which you can then verify using [`password_verify()`](https://php.net/manual/en/function.password-verify.php). Take a look at this post: [How to use password_hash](https://stackoverflow.com/q/30279321/1839439) and learn more about [bcrypt & password hashing in PHP](https://stackoverflow.com/a/6337021/1839439) – Dharman May 24 '22 at 14:38
  • Read about [Variable scope](https://www.php.net/manual/en/language.variables.scope.php), `$mysqli` is not available inside the function – brombeer May 24 '22 at 14:39
  • 1
    It looks like you are using some really bad tutorial. I highly encourage you to find something better. If you are only starting to learn PHP then you should learn PDO instead of mysqli. PDO is much easier and more suitable for beginners. Start here https://phpdelusions.net/pdo & https://websitebeaver.com/php-pdo-prepared-statements-to-prevent-sql-injection. Here are some good video tutorials https://youtu.be/2eebptXfEvw & https://www.youtube.com/watch?v=sVbEyFZKgqk&list=PLr3d3QYzkw2xabQRUpcZ_IBk9W50M9pe- – Dharman May 24 '22 at 14:39

0 Answers0