等待mysql服务器的响应很简单

Question

I'm new to programming and wrote a basic login script (or rather watched a tutorial), but my output in Unity is at first "User nicht gefunden" and about one second later "User gefunden".

My question: Can I somehow wait for a response from the mysql server in a easy way and still recognize a missing connection?

Unityscript:

public string inputusername;
public string inputpassword;

public string URL = "http://localhost/login.php";


void Start () {

}


void Update () {
    if (Input.GetKeyDown(KeyCode.L))
    {
       StartCoroutine(LoginToDB(inputusername, inputpassword));
    }
}

IEnumerator LoginToDB(string username, string password)
{
    WWWForm form = new WWWForm();
    form.AddField("usernamePost", username);
    form.AddField("passwordPost", password);

    WWW www = new WWW(URL, form);
    yield return www;


    if(www.text == "wrong")
    {
        Debug.Log("User nicht gefunden");
    }
    if(www.text == "correct")
    {
        Debug.Log("User gefunden");
    }


}

Phpscript:

$servername = "localhost";
$username = "root";
$password = "********";
$dbName = "test";

$user_username = $_POST["usernamePost"];
$user_password = $_POST["passwordPost"];

 $conn = new mysqli($servername, $username, $password, $dbName);

if(!$conn){
    die("Verbindung Fehlgeschlagen!". mysqli_connect_error());
}

$sql = "SELECT password FROM users WHERE username = '".$user_username."' ";
$result = mysqli_query($conn, $sql);



if(mysqli_num_rows($result) > 0){

    while($row = mysqli_fetch_assoc($result)){

         if($row['password'] == $user_password){
             echo "correct";
         } 

         else{

                echo "wrong";
         }

    }

}else {
    echo"not here";

}

Sorry in advance for the probably simple question.

Answer 1

I see three issues here:

while($row = mysqli_fetch_assoc($result)){

     if($row['password'] == $user_password){
         echo "correct";
     } 

     else{

            echo "wrong";
     }

}

1. You aren't checking that the passed in user matches the user in the database. Multiple users with the same password could log in add each other!
2. You are returning multiple responses, this is why you see "wrong password" initially
3. You aren't salting and hashing your passwords. This is inherently insecure.