php - mysqli准备给我错误qhen开始登录

Question

I create this code to check user login based in a form. But is giving me erros..Is not finding nothing... just say "INVALID USERNAME/PASSWORD Combination!"

    $uid = mysqli_real_escape_string($con, sanitize($_POST['email']));
$pwd = mysqli_real_escape_string($con, sanitize($_POST['password']));

if (empty($uid) || empty($pwd)) {

    header("Location: ../member?fail=1");
    exit();

} else {

    $stmt = $con->prepare("SELECT email, password FROM public_users WHERE email = ? AND password = ?");
    $stmt->bind_param('ss', $uid, $pwd);
    $stmt->execute();
    $stmt->bind_result($uid, $pwd);
    $stmt->store_result();

    if($stmt->num_rows == 1) {

        if($stmt->fetch()) {

           $secure_hash = password_verify($pwd, $stmt['password']);

           if($secure_hash == false) { 

              echo "Combination!";

           } else {

              echo "PASSWORD Combination!";
           }

        }

    } else {
        echo "INVALID USERNAME/PASSWORD Combination!";
    }        

}    

$stmt->close();

Please help this is for an text tomorrow at school :(

Answer 1

You tried to get an email and a password from your database, but the password field already hashed.

$stmt = $con->prepare("SELECT email, password FROM public_users WHERE email = ? AND password = ?");

You should get a record only by email:

$stmt = $con->prepare("SELECT email, password, age FROM public_users WHERE email = ? ");
$stmt->bind_param('s', $uid);
$stmt->execute();
$stmt->bind_result($uid, $hashed_password, $age);
$stmt->store_result();
//.....

and next verify password:

$secure_hash = password_verify($pwd, $hashed_password);