My login page for future users is allowing any username and any password access. This code is in a file called Login.php and should direct you to Account.php But it is taking you there regardless of what you type in the forms.
<?php
require 'Connections/Connections.php';
include('header.php');
?>
<?php
if(isset($_POST['Login'])){
$UN= $_POST['Username'];
$PW = $_POST['Password'];
$result = $con->query("Select * from users where Username='$UN' AND Password='$PW'");
$row = $result->fetch_array(MYSQLI_BOTH);
$_SESSION["UserID"] = $row['UserID'];
header('Location: Account.php');
}
?>
<!doctype html>
<html>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=utf-8'/>
<link href="style/UserStyle.css" rel="stylesheet" type="text/css" />
<title>Register</title>
</head>
<body>
<form action="" method="post" name="LoginForm" id="LoginForm">
<div class="FormElement">
<input name="Username" type="text" required="required" class="TField" id="Username" placeholder="Username">
</div>
<div class="FormElement">
<input name="Password" type="Password" required="required" class="TField" id="Password" placeholder="Password">
</div>
<div class="FormElement">
<input name="Login" type="submit" class="button" id="Login" placeholder="Login">
</div>
</body>
The connection.php that connects to my database and creates the variable $con
<?php
mysql_connect("localhost", "MyRealUsername", "MyRealPassword");
mysql_select_db("Registration");
$con = mysqli_connect("localhost", "MyRealUsername", "MyRealPassword", "Registration");
?>
Thank you very much for any help!
