I am learning from a book, which uses SHA1. I've changed the code to password_hash()
, by checking online. Here I query only the password and verify it. I managed get it working, but I feel a bit paranoid about the code. Is the code proper or wrong?
At registration:
//at registration
$p=mysqli_real_escape_string($dbcon, trim($_POST['psword1']));
$hash = password_hash($p,PASSWORD_DEFAULT);
//stores $hash in db.
At login:
<?php
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
//connect to db
require ('mysqli_connect.php');
//validate the email
if (!empty($_POST['email'])){
$e = mysqli_real_escape_string($dbcon, $_POST['email']);
}else {
$e = FALSE;
echo '<p class="error"> You forgot to enter your email.</p>';
}
// validate the password
if (!empty($_POST['psword'])){
$p=mysqli_real_escape_string($dbcon,$_POST['psword']);
} else {
$p = FALSE;
echo '<p class="error">You forgot to enter your password.</p>';
}
if (!empty($e && $p )){
//get email info
$sql = "SELECT psword FROM users WHERE email = '$e' LIMIT 1";
$query = mysqli_query($dbcon,$sql);
$row = mysqli_fetch_row($query);
$dbpassword=$row[0];
//run if email and password got value
if (password_verify($p,$dbpassword)){
// Retrieve the user_id, first_name
$q = "SELECT user_id, fname, user_level,lname,registration_date FROM users WHERE (email='$e')";
// Run the query and assign it to the variable $result
$result = mysqli_query ($dbcon, $q);
// Count the number of rows that match the email/password combination
if (@mysqli_num_rows($result) == 1) {//if one database row (record) matches
// Start the session, fetch the record and insert the three values in an array
session_start();
$_SESSION = mysqli_fetch_array ($result, MYSQLI_ASSOC);
// Ensure that the user level is an integer.
$_SESSION['user_level'] = (int) $_SESSION['user_level'];
// Use a ternary operation to set the URL
$url = ($_SESSION['user_level'] === 1) ? 'index.php' : 'members.php';
header('Location: ' . $url); // Make the browser load either the members’ or the admin page
exit(); // Cancel the rest of the script
mysqli_free_result($result);
mysqli_close($dbcon);
} else { // No match was made.
echo '<p class="error">The e-mail address and password entered do not match our records <br>Perhaps you need to register, just click the Register button on the header menu</p>';
}
} else { // If there was a problem.
echo '<p class="error">Please try again.</p>';
}
}
mysqli_close($dbcon);
}
?>