PDO登录系统无法正常工作

Question

I know I'll get a bunch of down-votes, but I am new to PDO and need to make a login system for a little web application. I can't seem to get it right:

<?php

include 'Config.php';

$username      = strtolower($_POST['username']);
$password      = md5($_POST['password']);
$hidden        = $_POST['hidden'];
$submit        = $_POST['submit'];
$host          = $config['mysql']['host'];
$mysql_user    = $config['mysql']['user'];
$mysql_pass    = $config['mysql']['pass'];
$db            = $config['mysql']['db'];

if(isset($username) && isset($password) && isset($submit) && !isset($hidden)) {

    try {
        $opt = array(PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION);
        $objDatabase = new PDO("mysql:host=" . $host . ";dbname=" . $db, $mysql_user, $mysql_pass, $opt);
        $objQuery    = $objDatabase->prepare("SELECT * FROM users WHERE username=:username");
        $objQuery->bindValue(':username', $username);
        $objQuery->execute();
        $row         = $objQuery->fetch(PDO::FETCH_ASSOC);
        if(!empty($row)) {
            if($username == $row['username'] && $password == $row['password']) {
                $_SESSION['logged_in'] = true;
                $_SESSION['username']  = $row['username'];
                header('Location: i/');
            } else
                header('Location: index.php?err=true&type=1');
        } else
            header('Location: index.php?err=true&type=2');
    } catch(PDOException $e) {
        die($e->getMessage());
    }

}

?>

I always get error 2 - account not found. I'm logging in with user "test" and password "test". In the database is an account with username "test" and the password is an MD5 hash of "test".

Answer 1

Your sql statement is wrong:

SELECT * FROM users WHERE username=':username'

You should not put your placeholder in quotes as now it is taken literally by mysql.

It should be:

SELECT * FROM users WHERE username=:username

You should also tell PDO to throw exceptions:

$opt = array(PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION);
$objDatabase = new PDO("mysql:host=" . $host . ";dbname=" . $db, $mysql_user, $mysql_pass, $opt);

So that it will tell you when something goes wrong.

Edit: As noted by @LozCheroneツ you also need to execute the query before you can fetch a row:

$objQuery->bindValue(':username', $username);
$objQuery->execute();