I've been trying to implement Google Authentication for my website for the longest time now, but programming really isn't my strongest suit. Below is my coding, and I would really appreciate if someone would please point out why it isn't working properly. At the moment, I am able to dynamically create a QR Code that can be scanned with the Google Authentication application, which would produce the one-time code. However, the issue is, when I key in the code, it will always say that I'm wrong, regardless of whether or not I keyed in the right code. Please be patient with me, as I said, I'm not really good with PHP.
<?php
session_start();
require 'GoogleAuthenticator.php';
$ga = new PHPGangsta_GoogleAuthenticator();
$secret = $ga->createSecret();
echo 'Secret:'.$secret; //echo-ed the secret so it would be easier for you guys
$qrCodeUrl = $ga->getQRCodeGoogleUrl('Three Musketeers', $secret);
$oneCode = $ga->getCode($secret);
echo 'One-Code:'.$oneCode; //echo-ed the oneCode so you guys wouldn't need to scan the QR Code everytime
$_SESSION['oneCode'] = $oneCode;
?>
<br>
<br>
<html>
<head>
<title>PHP Test</title>
</head>
<body>
<img src="<?php echo ''.$qrCodeUrl;?>" />
<form action="2fa.php" method="POST">
Code: <input type="text" name="code" maxlength="6"><br>
<input type="submit" name="submit" value="submit">
</form>
<?php
if(isset($_POST['submit']))
{
$code = $_POST["code"];
if (empty($_POST['code']))
{
echo "<script>alert('EMPTY');</script>";
}
else
{
if ($code == $_SESSION['oneCode']) //I tried just putting $code == $oneCode, but it doesn't work as well. However, you guys may feel free to try anyway
{
echo "<script>alert('CORRECT');</script>";
}
else
{
echo "<script>alert('WRONG');</script>";
}
}
}
?>
</body>
</html>