Simple AJAX login/register script

Question

I'm using Twitter Bootstrap. I haven't coded anything significant web design related in a while, because I've been doing desktop stuff and games. I'm trying to get back into the flow of things. Can anyone tell me if what I have is sufficient without going into ridiculous detail (the script, not the answer)?

Partial HTML:

<div class='container' id="loginContainer">
<h3>Login</h3>
    <form method="post" name="login" id="login" action="" class="form-horizontal">
        <div class="control-group">
        <label class="control-label" for="inputLoginUsername">Username</label>
        <div class="controls">
        <input type="text" id="inputLoginUsername" name="inputLoginUsername" required placeholder="Username" />
        </div>
        </div>

<div class="control-group">
<label class="control-label" for="inputLoginPassword">Password</label>
<div class="controls">
<input type="password" id="inputLoginPassword" name="inputLoginPassword" required placeholder="Password">
</div>
</div>

    <div class="control-group">
    <div class="controls">
        <button type="submit" name="inputLoginSubmit" id="inputLoginSubmit" class="btn btn-default">Submit</button>
    </div>
    </div>
    </form>
</div>

JavaScript:

$(document).ready(function() {
    $('#register').submit(function(event) {
        event.preventDefault();
        $.post('process.php', {
            inputRegisterSubmit: '',
            inputRegisterUsername: $('#inputRegisterUsername').val(),
            inputRegisterPassword: $('#inputRegisterPassword').val(),
            inputConfirmPassword: $('#inputConfirmPassword').val()
        }).done(function(data) {
            $('#registerOutput').html(data);
            if (data.indexOf("success") !== -1)
                $('#registerContainer').slideUp();
        });
    });

    $('#login').submit(function(event) {
        event.preventDefault();
        $.post('process.php', {
            inputLoginSubmit: '',
            inputLoginUsername: $('#inputLoginUsername').val(),
            inputLoginPassword: $('#inputLoginPassword').val()
        }).done(function(data) {
            $('#loginOutput').html(data);
            if (data.indexOf("success") !== -1)
                $('#loginContainer').slideUp();
        });
    });
});

PHP:

<?php
$mysqli = new mysqli("localhost", "user", "pass", "database");
if ($mysqli->connect_errno) {
    echo "Failed to connect to MySQL: (" . $mysqli->connect_errno . ") " . $mysqli->connect_error;
}

if (isset($_POST['inputRegisterSubmit']))
{

    if (!($stmt = $mysqli->prepare("INSERT INTO users(user_name, user_pass, user_email, user_date) VALUES (?, ?, ?, ?)"))) {
        echo "Prepare failed: (" . $mysqli->errno . ") " . $mysqli->error;
    }


    $user_name = $_POST['inputRegisterUsername'];
    $user_pass = $_POST['inputRegisterPassword'];
    $user_confirm = $_POST['inputConfirmPassword'];
    if ($user_pass != $user_confirm) echo "<p class='text-error'>Your passwords don't match.</p>";
    else {
        $user_email = '[email protected]';
        if (!$stmt->bind_param("ssss", $user_name, $user_pass, $user_email, date("Y-m-d H:i:s"))) {
            echo "Binding parameters failed: (" . $stmt->errno . ") " . $stmt->error;
        }

        if (!$stmt->execute()) {
            echo "Execute failed: (" . $stmt->errno . ") " . $stmt->error;
        }
        $stmt->close();
        echo "<p class='text-success'>Log in now!</p>";
    }
} else if (isset($_POST['inputLoginSubmit'])) {

    if (!($stmt = $mysqli->prepare("SELECT user_name FROM users WHERE user_pass = ?"))) {
        echo "Prepare failed: (" . $mysqli->errno . ") " . $mysqli->error;
    }

    $user_name = $_POST['inputLoginUsername'];
    $user_pass = $_POST['inputLoginPassword'];

    if (!$stmt->bind_param("s", $user_pass)) {
        echo "Binding parameters failed: (" . $stmt->errno . ") " . $stmt->error;
    }



    if (!$stmt->execute()) {
        echo "Execute failed: (" . $stmt->errno . ") " . $stmt->error;
    }

    $stmt->store_result();



    if ($stmt->num_rows <= 0)
        echo "<p class='text-error'>Invalid user/pass combination.</p>";
    else
        echo "<p class='text-success'>Logging you in now!</p>";

    $stmt->close();
} else header('Location: http://www.site.com/');

$mysqli->close();
?>

Answer 1

If you plan on putting this out in the wild (the web), I suggest you handle your error feedback a little more user friendly. If this is for your home server and you'll be the only one using it, it's fine. But displaying binding or executing errors definitely helps attackers get an insight of your methods.

Also, you seem to have forgotten to actually check the username when they log in? You're seeing if there's a row with that password (more on that below), and then if there's one or more accounts with that password, you log them in?

You should be checking to make sure there is exactly one row with the user-submitted username and password. Perhaps you accidentally just forgot this part!

More on your passwords! You have some protection: you're binding. But that's it? You're storing your passwords in plain text! Go ahead and read this to learn a bit more on how you should be keeping your sensitive data in databases!