无法以注册用户身份登录（php和mysql）

Question

I'm trying to do a log in and registration script. I've managed to finish most of it; however, after I register a user I am unable to log in as that user. That is, registered users are unable to log in. Any help would be massively appreciated! :)

This is the code that relates to the specific problem:

$login = login ($username, $password);
        if ($login === false) {
         $errors [] = 'That username/password combination is incorrect';
        } else {
           $_SESSION ['user_id'] = $login;
           header ('Location: index.php');
           exit (); 
    }       


function  login ($username, $password) {
   $user_id = user_id_from_username ($username);

   $username = sanitize ($username);
   $password = md5($password);

return (mysql_result(mysql_query("SELECT COUNT(user_id) FROM users WHERE username =     '$username' AND password = '$password'"), 0) == 1) ? $user_id : false;
}

I wrote the query above like this (BELOW), earlier. Writing it this way allowed me to log in but with "literally" any password.

function login ($username, $password){ 
  $user_id = user_id_from_username ($username);

  $username = sanitize ($username); 
  $password = sanitize ($password); 

  $query1 = mysql_query("SELECT COUNT(user_id) FROM users WHERE username =     '$username'"); 

 $query2 =  mysql_query("SELECT COUNT(user_id) FROM users WHERE password = '$password'"); 

 return  (mysql_result($query1, 0) == 1) ? $user_id : false; 
 return (mysql_result($query2, 0) == 1) ? $user_id : false;

That is to say, I broke the query down into two parts, but noticed the password query was completely irrelevant (even if I "commented" it out).

PS. I know I should be using PDO or Mysqli instead of mysql queries, and that md5 isn’t that secure. Just ignore these things for the sake of this riddle.

Answer 1

You really should break up your DB query operations in such a manner that you handle the query results in a thorough manner. Get in the practice of doing this. It will save you lots of time in debugging DB query issues.

Also, there is no need to query the DB twice here (which I assume is what you are doing with your user_id_from_username() function call. Just get rid of this entirely and design your query to get the information you need all at once.

Finally you really should get in the habit of specifying your database connections explicitly. In this case I pass the DB connection into the function.

Putting it all together you end up with something like this:

function  login ($username, $password, $db_conn) {
    $username = sanitize ($username);
    $password = md5($password);

    $query = "SELECT user_id FROM users WHERE username = '$username' AND password = '$password'";
    $result = mysql_query($query, $db_conn);

    if (false === $result) { // the query failed
        throw new Exception('Database failed with message: ' . mysql_error());
    }

    $rows = mysql_num_rows($result);
    if (0 === $rows) { // no record found
        return false;
    } else if ($rows > 1) { // too many records found.. really your DB indexes should disallow this
        return false;
    }

    $user_id = mysql_result($result, 0 , 'user_id');
    return $user_id;
}

Of course you already mentioned that you are aware that your should be using mysqli or PDO. I can't urge you strongly enough to start using one of those, as mysql is deprecated and you will find you have to start learning one of those others soon anyway, so you might as well start now.