I have small question. I don't know much about JavaScript (jQuery) or AJAX and I don't know whether I'm doing it safe from XSS Attacks, SQL injection and that stuff. I think the PHP with MySQL would be written right. The code works, I have added it below.
This is PHP with database call which is called by AJAX
if(isset($_POST["userLoginSubmit"]) == true){
if(!isset($_SESSION["userID"])){
userLogin(filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL), $_POST["password"]);
}
}
function userLogin($email, $password){
$return = [
"email" => "",
"password" => "",
"error" => false
];
if(empty($email)){
$return["email"] = "empty";
$return["error"] = true;
}
if(empty($password)){
$return["password"] = "empty";
$return["error"] = true;
}
if($return["error"] == true){
echo(json_encode($return));
return false;
}
$dbConnect = new DbConnect;
$dbDoConnect = $dbConnect->doConnectFromOutside();
$selectCommand = "SELECT *
FROM users
WHERE email = :email LIMIT 1";
$data = $dbDoConnect->prepare($selectCommand);
$data->bindValue(":email", $email, PDO::PARAM_STR);
if(!$data->execute()){
$return['error'] = "connection";
echo(json_encode($return));
return false;
}
if($data->rowCount() > 0){
$selectedData = $data->fetch(PDO::FETCH_ASSOC);
} else{
$return["email"] = "free";
echo(json_encode($return));
return false;
}
if(!password_verify($password, $selectedData["password"])){
$return["password"] = "badPassword";
echo(json_encode($return));
return false;
}
$_SESSION["userID"] = $selectedData["userID"];
$_SESSION["firstName"] = $selectedData["firstName"];
$_SESSION["lastName"] = $selectedData["lastName"];
$_SESSION["email"] = $selectedData["email"];
$return["error"] = "success";
echo(json_encode($return));
return true;
}
This is login form
<div class='signIn'>
<i class='fas fa-times fa-2x accountPopupSwitch'></i>
<h1>přihlášení</h1>
<p>NEMÁM ŮČET A <a href='#' class='changeForm preventDefault'>CHCI HO VYTVOŘIT</a></p>
<form method='POST' name='userLogin' id='userLogin'>
<input type='email' id='userLoginEmail' name='email' placeholder='Váš email' class='removableVal'>
<label for='userLoginEmail' id='userLoginEmailLabel' class='removableVal'></label>
<input type='password' id='userLoginPassword' name='password' placeholder='Heslo' class='removableVal'>
<label for='userLoginPassword' id='userLoginPasswordLabel' class='removableVal'></label>
<p id='userLoginMessage'></p>
<button type='submit' id='userLoginSubmit'>PŘIHLÁSIT SE</button>
</form>
<p>NEMÁM ŮČET A <a href='#' class='changeForm preventDefault'>CHCI HO VYTVOŘIT</a></p>
</div>
And this is AJAX which is submitted when user try to log in
$("#userLogin").submit(function(event){
event.preventDefault();
var email = $("#userLoginEmail").val(),
password = $("#userLoginPassword").val();
$("#userLoginSubmit").html("<i class='fas fa-sync'></i>");
$.ajax({
method: "POST",
url: "accountPopupFunctions.php",
data: {
email: email,
password: password,
userLoginSubmit: true
},
dataType: "json",
success: function(loginResults){
$("#userLoginPasswordLabel, #userLoginEmailLabel, #userLoginMessage").removeClass("error").html("");
$("#userLoginPassword").val("");
$("#userLoginSubmit").html("PŘIHLÁSIT SE");
if(loginResults["email"] == "empty") $("#userLoginEmailLabel").addClass("error").html("nevyplněný email");
if(loginResults["email"] == "free") $("#userLoginEmailLabel").addClass("error").html("neexistující email");
if(loginResults["password"] == "empty") $("#userLoginPasswordLabel").addClass("error").html("nevyplněné heslo");
if(loginResults["password"] == "badPassword") $("#userLoginPasswordLabel").addClass("error").html("špatné heslo");
if(loginResults["error"] == "connection") $("#userLoginMessage").addClass("error").html("Chyba v připojení (#003).");
if(loginResults["error"] == "success"){
localStorage.setItem('logged', true);
localStorage.removeItem('loggedOut');
localStorage.removeItem('loggedPopup');
localStorage.removeItem('unlogedPopup');
$(location).attr("href", "index.php");
}
},
error: function(){
$("#userLoginMessage").addClass("error").html("Něco se pokazilo (#003).");
$("#userLoginSubmit").html("PŘIHLÁSIT SE");
}
});
});
"firstName"
with"fistName"
is doomed. \$\endgroup\$