laravel中的登录系统

Question

I have a system login here the system works but when I enter the email data randomly into my system error(in there must roleback to login and show message). but when I enter a random password and true email my code its work i mean my if. how to fix the email ?

here my code view for login :

        @if ( Session::get('message') != '' )
        <div class='alert alert-warning'>
            {{ Session::get('message') }}
        </div>  
        @endif 

        <p class="login-box-msg">Login untuk masuk</p>
        <form action="{{ action('LoginController@postLogin') }}" method="post">
          <input type="hidden" name="_token" value="{{ csrf_token() }}" />
          <div class="form-group has-feedback">
            <input type="text" class="form-control" name='email' required placeholder="Email"/>
            <span class="glyphicon glyphicon-user form-control-feedback"></span>
          </div>
          <div class="form-group has-feedback">
            <input type="password" class="form-control" name='password' required />
            <span class="glyphicon glyphicon-lock form-control-feedback"></span>
          </div>
          <div class="row">
            <div class="col-xs-8 hide">    
              <div class="checkbox icheck">
                <label>
                  <input type="checkbox"> Remember Me
                </label>
              </div>                        
            </div><!-- /.col -->
            <div class="col-xs-4">
              <button type="submit" class="btn btn-primary btn-block btn-flat">Sign In</button>
            </div><!-- /.col -->
          </div>
        </form>

        <br/>
        <!--a href="#">I forgot my password</a-->

      </div><!-- /.login-box-body -->
    </div><!-- /.login-box -->

and this my controller :

public function getIndex()
    {
        if(Session::get('admin_id')!='') return redirect('/');

        $data['page_title'] = "Login Area";
        return view('login',$data);
    }

    public function postLogin() {
        $email      = Request::get('email');
        $password   = Request::get('password');

        if($email && $password) {
            $users = cms_users::whereRaw("email = '$email'")->first();
            if(!Hash::check($password,$users->password)) 
            {
                return redirect('/')->with('message', 'Gagal login email atau password salah !');
            }else{
                Session::put('admin_id',$users->id);
                Session::put('name',$users->name);
                Session::put('email',$users->email);
                Session::put('photo',$users->photo);
                Session::put('username',$users->username);
                return redirect('companies');
            }
        }else{
            return redirect('/')->with('message', 'Anda belum mengisi email dan password dengan benar !');
        }
    }

Answer 1

$users = cms_users::whereRaw("email = '$email'")->first(); replace with $users = cms_users::where("email", $email)->first();

And you do not check if user exists in the DB.

$user = cms_users::where("email", $email)->first();
if($user){
    if(!Hash::check($password,$users->password)) {
        return redirect('/')->with('message', 'Gagal login email atau password salah !');
    }
    ...
} else{
     //redirect because user with input email is empty in DB
}