PHP PDO登录过程不起作用

Question

I have made a Login Script with Php Data Objects. However it's not working properly the problem is it will let any user login even if password do not match the database record. I am really confused at this part and i am unable to figure it out.

$case = 1;
include("common/top.php");
if(isset($_SESSION['STAKEZONE']))
{
    header("Location: dashboard.php");
}
if(!empty($_POST['login']))
{
    if($_POST['username'] == '')
    {
        $msg = 'Please Enter your Username! <br>';
        $case = 0;
    }
    if($_POST['password'] == '')
    {
        $msg = 'Please Enter your Password!';
        $case = 0;
    }
    if($case == 1)
    {
        $username = $_POST['username'];
        $password = $_POST['password'];
        $sql = $dbh->prepare("SELECT * FROM users WHERE username = ?");
        $sql->execute(array($username));
        while($u = $sql->fetch())
        {
            $id = $u['id'];
            $password_query = $u['password'];
            $lastip = $u['lastip'];
            $status = $u['status'];
        }
        $row = $sql->fetch(PDO::FETCH_ASSOC);
        if($status == '0' && $row)
        {
            $msg = base64_encode('Your Account is Inactive');
            header("Location: login.php?msg=$msg");
            die;
        }
        $password_md5 = md5($password);
        if($password_md5 = $password_query)
        {
            $sql = "UPDATE users
                    SET lastip = ?
                    WHERE id = ?";
            $q = $dbh->prepare($sql);
            $q->execute(array($_SERVER['REMOTE_ADDR'],$id));

            $_SESSION['STAKEZONE']['user'] = $username;
            $_SESSION['STAKEZONE']['id'] = $id;
            header("Location: dashboard.php");
            die;
        }
        else
        {
            $msg = base64_encode("Wrong Username Or Password");
            header("Location: login.php?msg=$msg");
            die;
        }
    }
    else
    {
        header("Location: login.php?msg=$msg");  
        die;
    }
}

Thanks for the Help, Much Appreciated.

Answer 1

You have a typo. You need to change following line

if($password_md5 = $password_query)

into following

if($password_md5 == $password_query)