I'm Trying To Let users Login
on control page:
<?php include"files/header.php";?>
<?php
global $tf_handle;
$u_name = strip_tags($_POST['u_name']);
$u_pass = md5($_POST['u_pass']);
if(isset($_POST['login']))
{
if(empty($u_name) or empty($u_pass))
{
echo"
<div class='error'>Fill the The Form PLease</div><br />
";
}
else
{
$sqlquery = mysqli_query($tf_handle,"SELECT * FROM user WHERE u_name = '".$u_name."' AND u_pass = '".$u_pass."'");
if(mysqli_num_rows($sqlquery) > 0)
{
$fetchLquery = mysqli_fetch_object($sqlquery);
print_r($fetchLquery);
$uid = $fetchLquery->u_id;
$uname = $fetchLquery->u_name;
echo "$uname";
$upass = $fetchLquery->u_pass;
if($uname != $u_name )
{
//AND $upass != $u_pass
echo"
<div class='error'>wrong name</div><br />
";
}
else
{
setcookie("uid",$uid,time()+60*60*24);
setcookie("login",1,time()+60*60*24);
echo"
<div class='error'>Done !</div><br />
";
header('Refresh: 3;url=index.php');
}
}
else
{
echo"
<div class='error'>Wrong information</div><br />
";
}
}
}
?>
<div class="rightco">
<div class="B_t_in">
<div class="title_b">
<h3>Pen Testing</h3>
</div>
<div class="info">
By : ~Hacker~
Date :30/5/2015
</div>
</div>
<table class="tb" width="100%" border="0" >
<tr>
<td width="20%"><div class="pic"><img src="http://3.bp.blogspot.com/-xUY6gP4Uhgw/U7ADSxKjwBI/AAAAAAAABM8/uVAbk_D06Wg/s1600/php-framework1+copy.png" alt="" /></div> </td>
<td width="80%">
<p>
Test Test Test Test Test Test Test Test TestTest Test Test Test Test Test Test Test Tes
Test Test Test Test Test Test Test Test Test
</p>
</td>
</tr>
</table>
<div class="more"><a href="#">Read More !</a></div>
</div>
<?php include"files/block.php";?>
<?php include"files/footer.php";?>
The Result is
Wrong Name
& i tried to echo the Variables to check it
$fetchLquery = stdClass Object ( [u_id] => 3 [u_name] => memo [u_pass] => 202cb962ac59075b964b07152d234b70 [u_email] => jankeh@yahoo.com [u_ulv] => 1 )
$uname = 'memo'
This condition if($uname != $u_name ) shouldn't be executed
i don't know what's the reason of this problem !
i should check another thing ?
You don't need to be checking if the names match anyway.
Why?
Your query will only return data if the username and password match those that you have put into the query. You're doing the same thing twice - once in SQL and again in PHP!
You just need to check if anything has been returned from the query. If it has, you know it's a match! :)