vir.php
<?php
require_once '../db.php';
session_start();
if($_SERVER['REQUEST_METHOD'] == 'POST'){
$username = trim($_POST['username']);
try{
$Query = "SELECT * FROM users WHERE username = :username";
$statement = $conn->prepare($Query);
$statement->bindValue(':username', $username);
$statement->execute();
$user = $statement->fetch(PDO::FETCH_ASSOC);
$RowCount = $statement->rowCount();
} catch (PDOerrorInfo $e){
die('QuerySCD Error '.$e->getMessage());
}
if( $RowCount == 0 ){
// User doesn't exist
$_SESSION['message'] = "error!";
header("location: error-login.php");
} else{ // User exists
if( password_verify($_POST['password'], $user['password'])){
$_SESSION['username'] = $user['username'];
$_SESSION['active'] = $user['active'];
$_SESSION['logged_in'] = true;
header("location: riscar.php");
} else {
$_SESSION['message'] = "error!";
header("location: error-login.php");
}
}
}
$conn = NULL;
?>
<!DOCTYPE html>
<html lang="pt_BR">
<head>
<title>Login</title>
<meta charset="UTF-8">
</head>
<body>
<form action="vir.php" method="post" autocomplete="off">
<input type="username" required autocomplete="off" name="username">
<span data-placeholder="User"></span>
<input type="password" required autocomplete="off" name="password">
<span data-placeholder="Password"></span>
<button name="login">
Logar
</button>
</form>
</body>
</html>
ir.php
<?php
/* Log out process, unsets and destroys session variables */
session_start();
session_unset();
session_destroy();
?>
<!DOCTYPE html>
<html lang="pt_BR">
<head>
<title>Login</title>
<meta charset="UTF-8">
</head>
<body>
<p><?= 'You have been logged out!'; ?></p>
</body>
</html>
error-login.php
<?php
/* Displays all error messages */
session_start();
?>
<!DOCTYPE html>
<html lang="pt_BR">
<head>
<title>Login</title>
<meta charset="UTF-8">
</head>
<body>
<h4>
<?php
if( isset($_SESSION['message']) AND !empty($_SESSION['message']) ):
echo $_SESSION['message'];
else:
header( "location: vir.php" );
endif;
?>
</h4>
</body>
</html>
Only me will use this login sytem and only me will have the link to this login system, i will use this to insert records on my database.
I don't know if someone could find the link to this login, to i used PDO prepared statement, so prevent against SQL Injection.
How safe is my code?
undefined variableerror for$RowCount. \$\endgroup\$