PHP login forms not working

Question

I have been making/learning some PHP, and I successfully made a login form. When I have tried to replicate this, it doesn't work at all.

--MY HTML--

<!DOCTYPE html>
<html>
<head>
    <title>Login</title>
</head>
<body>
    <form method="post" action="login.php">
    <input type="text" name="usrname" placeholder=" Username">
    <br />
    <br />
    <input type="password" name="passwd" placeholder=" Password">
    <br />
    <br />
    <input type="password" name="pin" placeholder=" PIN #">
    <br />
    <br />
    <input type="submit" value="Login">
    </form>
</body>
</html>

--LOGIN.PHP--

<?php
    session_start();
    include('php/db.php');
    $usrname = $_POST['usrname'];
    $passwd = $_POST['passwd'];
    $pin = $_POST['pin'];


    $sql = "SELECT * FROM users WHERE usrname = 'usrname'";
    $query = mysql_query($sql);
    $row = mysql_fetch_array($query);
    $usrnameFromDB = $row['usrname'];
    $passwdFromDB = $row['passwd'];
    $pinFromDB = $row['pin'];

    if($usrnameFromDB == $usrname && $passwdFromDB == $passwd && $pinFromDB == $pin) {
        echo "Correct";
    } else {
        echo "noooooo"; 
    }
?>

<!DOCTYPE html>
<html>
<head>
    <title>trhhytrh</title>
</head>
<body>

</body>
</html>

P.S. When comparing the codes, there is no major difference apart from the names. Also, the code provided is the one that isn't working. Thanks in advance! :)

Stop using deprecated mysql_* API. Use mysqli_* or PDO instead — Jens
– Jens, Commented Aug 20, 2016 at 19:25
When i am making proper sites, I use mysqli, but this site is for my kids so they can have a bank so if they do chores I will pay them. I am not concerned about security but thanks anyway. — orbit
– orbit, Commented Aug 20, 2016 at 19:27

Funk Forty Niner · Accepted Answer · 2016-08-20 19:45:39Z

1

As I stated in comments:

WHERE usrname = 'usrname'"; it should read as WHERE usrname = '$usrname'";

You're presently looking/querying for the string literal of "usrname" in your database, rather than the POST array's variable.

Heed the warnings about SQL injection. You should use a prepared statement and a safe password hashing function when your site does go live, such as password_hash().

You should not put that much trust in people.

References:

edited Aug 20, 2016 at 19:45

answered Aug 20, 2016 at 19:35

Funk Forty Niner

74.2k14 gold badges71 silver badges146 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

orbit Over a year ago

Will mark this as the answer when it lets me, I will also be planning on using md5 with a random 6 varchar salt. Also, unsure if it helps but I will also be using 'mysqli_real_escape_string' when my site goes live. Thankyou for the help kind sir!

Funk Forty Niner Over a year ago

@Skye You're welcome. I suggest you not use MD5 as it is no longer considered safe to use as a password storage method. Read the following security.stackexchange.com/questions/19906/… it outlines the reasons.

Zain Farooq · Accepted Answer · 2016-08-20 19:37:07Z

0

Try this:

Change this in html

<input type="submit" name="submit" value="Login">

Then in php

<?php
session_start();
include('php/db.php');
if(isset $_POST['submit']){
$usrname = $_POST['usrname'];
$passwd = $_POST['passwd'];
$pin = $_POST['pin'];


$sql = "SELECT * FROM users WHERE usrname = '$usrname'";
$query = mysql_query($sql);
$row = mysql_fetch_array($query);
$usrnameFromDB = $row['usrname'];
$passwdFromDB = $row['passwd'];
$pinFromDB = $row['pin'];

if($usrnameFromDB == $usrname && $passwdFromDB == $passwd && $pinFromDB == $pin) {
    echo "Correct";
} else {
    echo "noooooo"; 
}
}//End of if

else
{
echo "Form is not submitted";
}
?>

You have not submitted the form. PS you have commited a mistake in your query. You were not using variable there

answered Aug 20, 2016 at 19:37

Zain Farooq

2,9664 gold badges24 silver badges49 bronze badges

2 Comments

orbit Over a year ago

I never knew the 'isset($_POST['submit'])' was a thing. I will be using this in all of my future sites, Thanks!

Zain Farooq Over a year ago

I think its better practice to wrap all of your form elements in single condition.

Collectives™ on Stack Overflow

PHP login forms not working

2 Answers 2

2 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related