在帐户页面上获取自动增量值（登录系统）

Question

So I'm creating a login section. However, I'm not sure if it actually logs the user in. I have a table with UserID (A_I), email, password and all the usual stuff. So when I log in, I'm trying to fetch and echo the UserID on the account page, just to show that the user is logged in, but still haven't got any success with it.

Login form:

<form method="post" action="">
            <div class="FormElement">
                    <input  name="email" type="text" required="required" class="TField"  placeholder="Email">
            </div>
            <div class="FormElement">
                    <input  type="Password" required="required" class="TField"  placeholder="Password">
            </div>
            <div class="FormElement">
                    <input name="LogIn"  type="submit" class="button" value="LogIn">
            </div>
        </form>

Login php script:

    <?php require 'Connections/Connections.php'; ?>
<?php

    if (isset($_POST['LogIn'])){

            $EM = $_POST['email'];
            $PW = $_POST['password'];
            $result = $con->query("select * from user where Email='$EM' AND Password='$PW'");

            $row = $result->fetch_array(MYSQLI_BOTH);
            session_start();
            $_SESSION["UserID"] = $row['UserID'];
            header('Location: Account.php');
    }
 ?>

As you can see in the script, we're heading to Account.php, where I am basically trying to:

<?php echo $_SESSION["UserID"]; ?>

However, no UserID is being echo'ed. No errors, notices or warnings.

The Connections.php ($con) is just a normal connection to the MYSQLI table, and it connects just fine.

Pretty new around here and any help is appreciated!

Thanks in advance.

Answer 1

You have to add the atribute name for your password field. Also it's good to use prepared statements and PDO. Finally, when you redirect your page add the exit method Why I have to call 'exit' after redirection through header('Location..') in PHP?.

<form method="post" action="youraction.php">
    <div class="FormElement">
        <input  name="email" type="text" required="required" class="TField"  placeholder="Email">
    </div>
    <div class="FormElement">
        <input name="password" type="Password" required="required" class="TField"  placeholder="Password">
    </div>
    <div class="FormElement">
        <input name="LogIn"  type="submit" class="button" value="LogIn">
    </div>
</form>

<?php

if (isset($_POST['LogIn'])) {
    session_start();

    try {
        //Make your connection handler to your database
        $conn = new PDO("mysql:host=".$servername.";dbname=".$database, $username, $password, array(PDO::ATTR_ERRMODE => PDO::ERRMODE_WARNING));

        $sql = "SELECT * FROM user WHERE Email = :email AND Password = :password";
        $stmt = $conn->prepare($sql);
        //Execute the query
        $stmt->execute(array(':email'=>$email, ':password'=>$password));
        $row = $stmt->fetch();
        if (count($row) > 0) {
            $_SESSION["UserID"] = $row['UserID'];
            header('Location: Account.php');
            exit();
        }

    } catch(PDOException $e) {
        echo $e->getMessage();
        die();
    }

}
?>