Develop Reference

how to display an alert after redirect to another page

login form (index.php) was already created. when form is submitted username and password are passed in to another page (login-controller.php). after verifying, if username or password is incorrect user was redirected to login form(index.php) after display the alert box in login-controller.php.but i want to display an alert box like "invalid login credentials" after redirect to login form(index.php). how can i solve this. code of login-controller.php are given bellow.
<?php
session_start();
if (isset($_SESSION['username'])) {
header('Location: ../service/index.php');
}
include '../include/conn.php'; //database connection
if (isset($_POST["submit"])) {
if (empty($_POST["username"] && $_POST["password"])) {
header('Location: index.php');
} else {
$username = mysqli_real_escape_string($conn, $_POST["username"]);
$password = mysqli_real_escape_string($conn, $_POST["password"]);
$password = md5($password);
$sqli = "SELECT * FROM user WHERE name = '$username' AND password = '$password'";
$result = $conn->query($sqli);
$count = mysqli_num_rows($result);
if ($count == 1) {
$_SESSION['username'] = $username;
header('Location: ../service/index.php');
} else {
include '../include/bootstrap.php'; //bootstrap js and css
echo '<div class="alert alert-danger"><strong>Oops!</strong> Invalid Login Credentials.</div>';
echo "<script>setTimeout(\"location.href = 'index.php';\",3000);</script>";
}
}
}
?>

Using session variables you can display alerts:
$_SESSION['alerts'][] = "Test Alert";
$_SESSION['alerts'][] = "Another Test Alert";
Then in your config, or any other .php file that gets executed on every page that you have ( If you have a templating system, do that in the template) do this:
if(isset($_SESSION['alerts'])){
foreach($_SESSION['alerts'] as $alertmessage){
echo '<div class="alert">' . $alertmessage . '</div>';
}
}

PHP query execute without error but return count 0

I am creating login in angularjs, in login.phppage i am verify whether user exist or not by number of rows exist or not means using rowCount() in php pdo but it always return 0 result. here is my php file:
<?php
/*
* Collect all Details from Angular HTTP Request.
*/
$postdata = file_get_contents("php://input");
$request = json_decode($postdata);
$email = $request->email;
$pass = $request->password;
$user ="root";
$pass ="m2n1shlko";
$dbh = new PDO('mysql:host=localhost;dbname=blog_db', $user, $pass);
$query = $dbh->prepare("SELECT * FROM `signup_tbl` WHERE `email`='$email' AND `password`='$pass'");
$query->execute();
$count = $query->rowcount();
if($count>0){
echo "You have sucessfully login with this Email: ".$count; //this will go back under "data" of angular call.
}else{
echo "Error While Authentication with this Email: " .$count;
}
/*
* You can use $email and $pass for further work. Such as Database calls.
*/
?>
Data from the controller get here I didn't know where i am missing the code. Apreciate if help .. Thanks

You overwrite $pass to database (line 13) and for user (line 8). Change database password to $db_pass.
...
$email = '...';
$pass = $request->password;
...
$db_pass = '...';
...
$dbh = new PDO('mysql:host=localhost;dbname=blog_db', $user, $db_pass); // $pass to $db_pass

Its $query->rowCount(); NOT $query->rowcount();
$count = $query->rowCount();
if($count>0){
echo "You have sucessfully login with this Email: ".$count; //this will go back under "data" of angular call.
}else{
echo "Error While Authentication with this Email: " .$count;
}
Read Manual rowCount

I have done in my local system,it's working good,Try like below example,this is working fine.just follow this example and do your code right way:
<?php
$host = "localhost";
$username = "root";
$password = "";
$dbname = "xxx";
// Create connection
$conn = new PDO('mysql:host=localhost;dbname=xxx', $username, $password);
$query =$conn->prepare("select * from testing");
$query->execute();
$count = $query->rowCount();
echo "Counting:".$count;
?>
Output:-
Counting:3

php login form pass vars

i have a page login
in page have html form with textboxes and submit button
and in top of page i have PHP code thet chacke if name and password in database
if name and password in database page go to new page and pass the name and password to next page
i can do it with get metod like the vars in the URL
but i want to pass and go to new page with Post metod
how i can do it??
pleas help me with code....
in code html :
form name="frmlogin"action="<?= $_SERVER['PHP_SELF'] ?>" method="post" >
and in top of the page have PHP code:
$msg = "";
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
$name = $_POST["name"];
$password = $_POST["password"]; if ($name == '' || $password == '') {
$msg = "You must enter all fields";
} else {
$sql = "SELECT * FROM tbluser WHERE fldUsername = '$name' AND fldPass = '$password'";
$query = mysql_query($sql);
if ($query === false) {
echo "Could not successfully run query ($sql) from DB: " . mysql_error();
exit;
}
if (mysql_num_rows($query) > 0) {
/*header('Location: YOUR_LOCATION');
exit;*/
$msg = "Username and password match";
echo '<script type="text/javascript">
window.location.href = "smartphon100.php?name='. $name .'&password='. $password .'";
}
if (mysql_num_rows($query) <= 0) {
$msg = "Username and password do not match";
}
}
}
help me to change the javascript window.location to post metod

You can go for php redirect also.
header('location:smartphon100.php?name='. $name .'&password='. $password) ;
BTW: you are passing password in browser?

If I understand correctly, you're trying to redirect a user after successfully logging in.
I see that your current code attempts to redirect using Javascript, the issue seems to be with the quotes on the value you tried to enter.
Try to change this line:
window.location.href = "smartphon100.php?name='. $name .'&password='. $password .'";
to this:
window.location.href = "smartphon100.php?name='.$name.'&password='. $password";
Overall you should read about security as the code you presented is very vulnerable.
PHP: SQL Injection - Manual
If you're trying to pass the values to another page in a POST method using Javascript, you could take a look at this answer:
JavaScript post request like a form submit
Although as I don't see a reason for posting the values more than once,
I recommend you to read about PHP sessions, cookies, and encryption, which allow you to store values that you can use across the website securely.
A simple example to using session:
<?php
//Starts the session, you need to use this line in every PHP file that'll need to access session variables
session_start();
$_SESSION['user'] = "Donny"; //Storing a user name
?>
A simple example of session use with your code:
Foo.php
session_start();
$msg = "";
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
$name = $_POST["name"];
$password = $_POST["password"]; if ($name == '' || $password == '') {
$msg = "You must enter all fields";
} else {
$sql = "SELECT * FROM tbluser WHERE fldUsername = '$name' AND fldPass = '$password'";
$query = mysql_query($sql);
if ($query === false) {
echo "Could not successfully run query ($sql) from DB: " . mysql_error();
exit;
}
if (mysql_num_rows($query) > 0) {
$_SESSION['user'] = $name;
$_SESSION['pass'] = $password;
$msg = "Username and password match";
echo '<script type="text/javascript">window.location.href = "smartphon100.php";</script>';
}
if (mysql_num_rows($query) <= 0) {
$msg = "Username and password do not match";
}
}
}
Bar.php
<?php
session_start();
//Accessing the values:
echo $_SESSION['user'];
echo $_SESSION['pass'];
?>
NOTE:
It's not good to store values like that as again, they're not secure, please read about hashing passwords.
PHP: Password Hashing

Error when comparing hashes when logging in

i'm creating a simple login system, i has the passwords using sha256 and store a salt using a random number in the database. However when i try to log in, when it goes to compare the hashes it fails. Can anyone see why?
<?php
session_start();
$username = $_POST['username'];
$password = $_POST['password'];
$mysql_db_hostname = "localhost";
$mysql_db_user = "root";
$mysql_db_database = "login";
$con = mysql_connect($mysql_db_hostname, $mysql_db_user) or die("Could not connect database");
mysql_select_db($mysql_db_database, $con) or die("Could not select database");
$query = "SELECT password, salt FROM registered_users WHERE username='$username'";
$result = mysql_query($query);
if(mysql_num_rows($result) < 1) //no such user exists
{
echo 'false';
header('Location: index.php');
}
$userData = mysql_fetch_array($result, MYSQL_ASSOC);
$hash = hash('sha256', $userData['salt'] . hash('sha256', $password) );
if($hash != $userData['password']) //incorrect password
{
echo 'false';
header('Location: index.php');
}
else
{
echo 'true';
$_SESSION['username']=$row['username'];
}
session_write_close();
Heres how i hash my pass
// hash the password using sha256 a string of 64 characters
$hash = hash('sha256', $password);
// create the salt, random string of characters appened to hash
function createSalt()
{
$string = md5(uniqid(rand(), true));
return substr($string, 0, 3);
}
$salt = createSalt();
$hash = hash('sha256', $salt . $hash);
Heres how i insert my data
mysql_query("INSERT INTO registered_users(username, name, email, password,salt)VALUES('$username', '$name', '$email', '$hash', '$salt')");
header("location: index.php?remarks-success");
mysql_close($con);
?>

Make sure you are storing the password in the database the same way you are checking it here.
So to put it in you should create the hash by first hashing the password, then rehashing it with a salt. If they don't match, then there is your problem.

Signup Verification

Every time I leave any textbox unfilled for the 1st time, it would be registered to the db same as if I leave all the textboxes empty but when you do it for the 2nd time (any of the two), that would be the time the alert box would pop-up... I don't what to do.
Help me please.
Here's my code:
<?php
ini_set('display_errors', 0);
$email= $_POST['email'];
$user= $_POST['user'];
$password= $_POST['password'];
$image =($_FILES['image']['name']);
$submit= $_POST['submit'];
if (empty($email) || empty($password) || empty($user) )
{
echo "<script type='text/javascript'>
alert('You did not complete all of the required fields');
window.location='blah2.php';
</script>";
}
if(isset($submit))
{
$con = mysqli_connect("localhost", "root", "", "top")
or die('error in connection'.mysqli_connect_error());
$q = "SELECT username , email FROM registries WHERE username = ? OR email = ?";
$stmt = mysqli_prepare ($con, $q);
mysqli_stmt_bind_param($stmt, 'ss', $user, $email);
mysqli_stmt_execute($stmt);
mysqli_stmt_bind_result($stmt, $user , $email);
mysqli_stmt_store_result($stmt);
$result = mysqli_stmt_num_rows($stmt);
if($result > 0)
{
echo "<script type='text/javascript'>
alert('Email address or Username is already taken. Please pick another one.');
window.location='blah2.php';
</script>";
}
else
{
$q="INSERT INTO registries VALUES (?,?,?,?)";
$stmt = mysqli_prepare($con, $q);
move_uploaded_file($_FILES["image"]["tmp_name"],"uploads/" . $_FILES["image"]["name"]);
mysqli_stmt_bind_param($stmt, 'ssss', $email, $user, $password, $image);
mysqli_stmt_execute($stmt);
mysqli_stmt_store_result($stmt);
mysqli_stmt_close($stmt);
header('Location: blah.php');
}
}

with this
$submit= $_POST['submit'];
$submit is always set
maybe you could try
if (isset($_POST['Submit']))
and for debugging purpose you could try to var_dump $email, $password and $user and check if maybe they are really empty when you post your form once or twice

If I understand you right then just move
if(isset($submit)){
on top of your code right after
ini_set('display_errors', 0);