php login form not working correctly when i add username functionality

Question

I created a login form in PHP and now I have a password, email and username stored in the database when I use this query in my database form works correctly

$query = "SELECT * FROM users WHERE email = '$email'  AND password='$password' ";

But when I add username functionality too it does not work correctly this is my username code

$query = "SELECT * FROM users WHERE username='$email' or email = '$email'  AND password='$password' ";

Basically what happens is this, when I add username functionality when I try to login with username and type any password it logs in but when I try with email and try any password it says invalid and it works only with correct password now I want it to work correctly with username too

this is my whole code

<?php
 session_start();
 if (!isset($_SESSION['is_login'])) {

   # code...

if (isset($_POST['btn_login'])) {
  $email = mysqli_real_escape_string($con,trim($_POST['email'])); 
  $password = mysqli_real_escape_string($con,md5(trim($_POST['password'])));

 $query = "SELECT * FROM users WHERE username='$email' or email = '$email'  AND password='$password' ";

 $fire = mysqli_query($con,$query);
 if ($fire) {
if (mysqli_num_rows($fire) == 1) {


  $_SESSION['is_login'] = 'true';
  $_SESSION['email'] = $email;

  header("Location: dashboard");

}else{
  $errorfname= '<p style="color:#cc0000;">invalid username or password</p>';
}
}
}
}else{
  header("Location: dashboard.php");
}
?>

yes both email and username have same input field @MadhurBhaiya — dhruv sunoly
– dhruv sunoly, Commented Oct 7, 2018 at 6:35
This might be an issue of operator precedence. Try WHERE (username='$email' or email = '$email') AND password... — msg
– msg, Commented Oct 7, 2018 at 6:35

Madhur Bhaiya · Accepted Answer · 2018-10-07 06:35:26Z

1

Need to use parentheses properly. Put parentheses ( .. ) around OR condition checking.

 $query = "SELECT * FROM users WHERE (username='$email' or email = '$email')  
                                      AND password='$password' ";

From MySQL Documentation:

AND, &&
XOR
OR, ||

AND takes higher precedence than OR. So, basically without using parentheses, email = '$email' AND password='$password' would have executed first. Now this may return false if password is incorrect. But then, username='$email' will be executed, and it will return true if correct email id is used. Now, true or false = true. So even with wrong password, but correct email id, anybody could have logged in.

answered Oct 7, 2018 at 6:35

Madhur Bhaiya

28.9k10 gold badges53 silver badges61 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Neeraj Shrestha · Accepted Answer · 2018-10-07 06:43:52Z

0

Your query should be

$query = "SELECT * FROM users WHERE (username='$email' or email = '$email')  AND password='$password' ";

answered Oct 7, 2018 at 6:43

Neeraj Shrestha

861 silver badge3 bronze badges

Collectives™ on Stack Overflow

php login form not working correctly when i add username functionality

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related