1
\$\begingroup\$

I need to review my code. I used prepared statements to select data from the database. Is there more sanitization needed or any other problem in the code? Rate it, please. Thanks.

<?php
session_start();
require_once './db_con.php';
require_once './funcs.php';
if ( $_SERVER['REQUEST_METHOD'] === 'POST') {
    $email = trim(filter_input(INPUT_POST, 'email'));
    $password = trim(filter_input(INPUT_POST, 'password'));
    $errs = array();
    if ( empty($email) ) {
        $errs[] = "Please enter your E-mail.";
    } elseif ( !filter_var($email, FILTER_VALIDATE_EMAIL) ) {
        $errs[] = "Please enter a valid E-mail.";
    }  
    if ( empty($password) ) {
        $errs[] = "Please enter your password.";
    } elseif (strlen($password) < 6) {
        $errs[] = "Your password must have  at least 6 characters.";
    }
    if ( !empty( $errs ) )  {
        foreach ($errs as $err) {
            echo $err.'</br >';
        }    
    } else {
        $stmt = $connection->prepare("SELECT `password` FROM `users` WHERE `email` = ?");
        $stmt->bind_param("s", $email);
        $stmt->execute();
        $result = $stmt->get_result();
        $rows_count = $result->num_rows;   
        if ( $rows_count === 1 ) {
            $row = $result->fetch_row();
            $hash = $row[0];
            if ( password_verify($password, $hash) ) {
                $_SESSION['email'] = $email;
                header('Location: index.php');
            } else {
                echo "Password is wrong.";
            }
        } else {
            echo "register.";
        }
        $stmt->close();
        }
}
?>

<!DOCTYPE html>
<html>
    <head>
        <meta charset="UTF-8">
        <title></title>
    </head>
    <body>
        <div id="wrapper">
            <form action="#" method="POST">
                <p><label>Enter Your E-mail: </label><input type="text" 
                name="email" value="" /></p>
                <p><label>Enter Your Password: </label><input 

    type="password"                   name="password" value="" /></p>
                <p><input type="submit" value="Log now" /></p>
            </form>
        </div>
    </body>
</html>
\$\endgroup\$
  • 2
    \$\begingroup\$ There's not much to say about this basic code. It works, no major flaws. Perhaps there could be better error handling. You use this nice $errs array yet you don't check for database error and you echo other errors directly. That's a bit inconsistent. \$\endgroup\$ – KIKO Software Jul 5 '18 at 15:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.