PHP PDO Login-Code - wiederholt Fehler, Login nicht möglich [korrekter Benutzername und Passwort wird eingegeben]

Question

Ich habe Schwierigkeiten, den Login-Code erfolgreich auszuführen. Es wird weiterhin der Abschnitt "Benutzername oder Passwort falsch ..." angezeigt, obwohl der richtige Benutzername und das richtige Passwort eingegeben wurden. Fehle ich irgendwo irgendwo, bitte hilf mir.

<?php 
//Check login details 
    session_start(); 
    //get user input from the form 
    if (isset($_POST['Submit'])) { 
     $username = checkData($_POST['username']); 
     $password = checkData($_POST['password']); 

     require ('config.php'); //database connection 
     global $dbselect; 

     $qry = 'SELECT username, password 
       FROM users 
       WHERE username = :username AND password = :password 
       LIMIT 1'; 
     $statement = $dbselect->prepare($qry); 
     $statement->bindValue(':username', $username); 
     $statement->bindValue(':password', $password); 
     $statement->execute(); 
     $login = $statement->fetch(PDO::FETCH_ASSOC); 
     if (count($login) > 0 && password_verify($password, $login['password'])) { 
      $_SESSION['username'] = $login['username']; 
      header('location:home.html'); 
     } else { 
      echo "Username or Password incorrect. Please try again."; 
     }  
     $statement->closeCursor(); 
    } 

    //validate data 
    function checkData($data) { 
     $data = trim($data); 
     $data = stripslashes($data); 
     $data = htmlspecialchars($data); 
     return $data; 
    } 
?> 

Answer 1

/** * Sie benötigen eine gehasht Kopie des Passworts an dem Punkt der * Erstellung eines Benutzers zu speichern, so dass Sie das eingegebene Passwort gegen die gehasht password_verify kann * Kopie von der DB zurück . * etwas wie dieses: * $ hashed = password_hash ($ password, PASSWORD_BCRYPT); * HINWEIS: Ich habe den Code zu einem gewissen Grad geändert, bitte anpassen. */

//Check login details 
session_start(); 
//get user input from the form 
if (isset($_POST['Submit'])) { 
    $username = checkData($username); 
    $password = checkData($password); 

    $dbname  = "testo"; 
    $servername = "localhost"; 
    $conn  = new PDO("mysql:host=$servername;dbname=$dbname", "root", ""); 
    $parr  = array($username,$password); 

    $qry = 'SELECT username, password, phashed 
    FROM users 
    WHERE username = ? AND password = ? 
    LIMIT 1'; 

    $stmt  = $conn->prepare($qry); 
    $Qres  = $stmt->execute($parr); 
    $login  = ($Qres) ? $stmt->fetchAll(PDO::FETCH_ASSOC) : array(); 

    if (count($login) > 0 && password_verify($password, $login[0]['phashed'])) { 
     $_SESSION['username'] = $login[0]['username']; 
     header('location:home.html'); 
    } else { 
     echo "Username or Password incorrect. Please try again."; 
    }  
    $conn = null; 
} 

//validate data 
function checkData($data) { 
    $data = trim($data); 
    $data = stripslashes($data); 
    $data = htmlspecialchars($data); 
    return $data; 
} 

Answer 2

Die in Test gemäß gearbeitet (bis zum password_verify wo ich einen anderen Test verwendet, wie ich PHP 5.3.2 und daher keine password_verify haben) ~ hoffentlich kann es von Vorteil erweisen.

<?php 
    session_start(); 

    /* error messages used to display to user */ 
    $ex=array(
     0 => 'One or more required POST variables are not set', 
     1 => 'Both username & password are required', 
     2 => 'Failed to prepare SQL query', 
     3 => 'Query failed', 
     4 => 'No results', 
     5 => 'Invalid login details' 
    ); 

    if($_SERVER['REQUEST_METHOD']=='POST'){ 
     try{ 
      if(isset($_POST['Submit'], $_POST['username'], $_POST['password'])) { 

       $username = !empty($_POST['username']) ? filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING) : false; 
       $password = !empty($_POST['password']) ? filter_input(INPUT_POST, 'password', FILTER_SANITIZE_STRING) : false; 

       if($username && $password){ 

        require('config.php'); 
        global $dbselect;/* ??? */ 

        /* use the username in the sql not password & username */ 
        $sql='select `username`, `password` 
          from `users` 
          where `username` = :username'; 
        $stmt=$dbselect->prepare($sql); 

        /* only proceed if prepared statement succeeded */ 
        if($stmt){ 
         $stmt->bindParam(':username', $username); 
         $status=$stmt->execute(); 

         if(!$status)throw new Exception('',3); 

         $rows=$stmt->rowCount(); 
         if(!$rows > 0)throw new Exception('',4); 

         $result = $stmt->fetchObject(); 
         $stmt->closeCursor(); 


         /* password_verify is available from PHP 5.5 onwards ~ I have 5.3.2 :(*/ 
         if($result && function_exists('password_verify') && password_verify($password, $result->password)){ 
          /* valid */ 
          $_SESSION['username']=$username; 
          exit(header('Location: home.html')); 
         } else { 
          /* bogus - invalid credentials */ 
          throw new Exception('',5); 
         } 
        } else { 
         /* sql prepared statement failed */ 
         throw new Exception('',2); 
        } 
       } else { 
        /* either username or password was empty */ 
        throw new Exception('',1); 
       } 
      } else { 
       /* one or more POST variables are not set */ 
       throw new Exception('',0); 
      } 
     }catch(Exception $e){ 

      /* set a session variable to ensure error message is displayed only once */ 
      $_SESSION['error']=$ex[ $e->getCode() ]; 

      /* reload the login page with error code */ 
      exit(header('Location: ?error=' . $e->getCode())); 
     } 
    } 
?> 

    <!doctype html> 
    <html> 
     <head> 
      <title>Login</title> 
     </head> 
     <body> 
     <!-- the php/html login page --> 

     <form method='post'> 
      <input type='text' name='username' /> 
      <input type='password' name='password' /> 
      <input type='submit' name='Submit' value='Login' /> 

      <?php 
       if($_SERVER['REQUEST_METHOD']=='GET' && isset($_GET['error'], $_SESSION['error'])){ 

        unset($_SESSION['error']); 

        /* display the error message */ 
        echo "<h2 style='color:red'>{$ex[ $_GET['error'] ]}</h2>"; 
       } 
      ?> 
     </form> 
     </body> 
    </html>