无法使用PHP登录系统

Question

May I know why it not redirect to the page that I've been looking for and I have some problem where if I enter the correct username its still show that I enter the wrong username/password. Here the snippet of my code. Anyone can help me? Thank you. And anyone how to make a session?

 <?php
    require('db.php');
    session_start();
    // If form submitted, insert values into the database.
    if (isset($_POST['username'])){

        $username = stripslashes($_REQUEST['username']); // removes backslashes
        $username = mysqli_real_escape_string($con,$username); //escapes special characters in a string
        $password = stripslashes($_REQUEST['password']);
        $password = mysqli_real_escape_string($con,$password);

    //Checking is user existing in the database or not
        $query = "SELECT * FROM `user` WHERE username='$username' and password='".md5($password)."'";
        $result = mysqli_query($con,$query) or die(mysqli_error());
        $rows = mysqli_num_rows($result);
        if($rows==1){
            $_SESSION['username'] = $username;
            header("Location: home.php"); // Redirect user to homeA.php
            }else{
                echo "<center><div class='form'><br><br><h1>Username/password is incorrect.</h1><br/>Click here to <a href='main.php'>Try Again</a></div></center>";
                }
                }
    else{
?>

Answer 1

To start of with, please use prepared statements instead of string concatenation to construct sql statements. An easy solution to this problem would be to use PDO. Second, never ever hash passwords using MD5. Password hashing in PHP is done using the password_hash() and password_verify() functions. Below is an example of how a login page could work using previously mentioned methods.

// Create a new PDO object using host (might be 127.0.0.1), dbname (your database name), user (your database username) and pass (your database password)
$dbh = new PDO('mysql:host=localhost;dbname=test', $user, $pass);

if (isset($_POST['username'])) {

    $stmt = $dbo->prepare('SELECT * FROM user WHERE username = :username');
    $stmt->bindParam(':username', $_POST['username']);

    if ($stmt->execute()) {
        $row = $stmt->fetch();

        if (password_verify($_POST['password'], $row['password'])) {
            // User password matched. Log them in
        } else {
            // User password didn't match
        }
    } else {
        // There was a problem executing query
    }

}

You will also need to hash your password using password_hash() when creating your users.

password_hash($password, PASSWORD_DEFAULT)