For some reason, my prepare statement doesn't seem to return any rows or login, although I'm sure the password and username being entered is correct; when running the code without the prepare statement, the system logs in. Would anyone happen to know why my prepare statement isn't working, or if there is some other method I should use?
<?php session_start(); ?>
<!DOCTYPE html>
<html>
<head>
<title>Logged in</title>
</head>
<body>
<?php
$user=$_GET["username"];
$pass=$_GET["password"];
$servername="localhost";
$username="root";
$password="";
$dbName="db_artzytest";
$conn=new mysqli($servername, $username, $password, $dbName);
if($conn->connect_error){
echo $conn->connect_error;
die("connection to server not found");
}else{
echo "connection established";
}
///finds account with matching login info
$sql="SELECT * FROM db_users WHERE username='{$user}' AND password='{$pass}' ";
$sql="SELECT * FROM db_users WHERE username = ? AND password = ?";
try{
$stmt = $conn->prepare($sql);
$stmt->bind_param("ss", $user, $pass);
$stmt->execute();
}catch(Exception $e){
die("prepare failed: " . $e);
}
echo 'here';
//$result = $stmt->store_result();
printf("Number of rows: %d.
", $stmt->num_rows);
//$result=$conn->query($sql);
echo 'here';
if( mysqli_num_rows($result) > 0 ){
while($row=mysqli_fetch_assoc($result)){
//only logs in if the account is activated
if($row["isActivated"]==1){
$_SESSION["currentUser"]=$user;
$_SESSION["currentId"]=$row["id"];
$_SESSION["currentPass"]=$pass;
//header( 'Location: ../ProfilePage/profilePage.php' );
header( 'Location: ../Content/displayGroup.php?group=general' );
}else{
$_SESSION["m_Login"]="Unverified Account. Check your email to verify.";
header('Location: Login.php');
}
}
/*
$sql=" SELECT * FROM table_images WHERE userid = {$_SESSION["currentId"]} ";
$result=$conn->query($sql);
if(mysqli_num_rows($result) > 0){
while($row=mysqli_fetch_assoc($result)){
echo "<img style='height: 10vh; width: 10vw;' src='../../images/{$row["id"]}.jpg' />";
echo "{$row["imageName"]}</br>";
}
}
*/
}else{
$_SESSION["m_Login"]="password or username incorrect {$user} {$pass}" . var_dump(mysqli_stmt_get_result($stmt) );
header('Location: Login.php');
echo "no user found";
}
?>
</body>
</html>
