How do I connect to a MySQLi db using PDO?

Question

I am creating a login form and am having trouble with it not successfully logging in. My form looks like this

<form method="post" action="phpScripts/loginProcess.php">

    <input type="text" name="uname" value="" placeholder="Username">

    <input type="password" name="pass" value="" placeholder="Password">

    <input id="submit" type="submit" value="submit">

</form>

I have already checked and I am connecting to the database, and my uname and pass are both correct. I have double checked plenty of times. The issue is within my query. Here is the loginProcess.php file

<?php

    require_once ('dbconn.php');



    if(isset($_POST['login'])){

        $uname  = mysqli_real_escape_string($_POST['uname']);
        $pass   = mysqli_real_escape_string($_POST['pass']);

        $query  = mysql_query ("SELECT * FROM staff WHERE uname='$uname'");
        $numrows = mysql_num_rows($query);

        if ($numrows !=0){
            die("Success!!");
        }
        else{
            die("That user doesnt exist");
        }

    }
    else{
        echo "Username or Password incorrect";
    }
?>

With the help of Fred-ii- I was able to figure out my mistakes and really quickly fix my login issue! I wanted to supply the code I used to login in case anyone else came across this problem.

Here is the code that I am using to login. I feel as I can make it a little less redundant with the execute and $userSql/$pwSql. Any suggestions to clean this up would be greatly appreciated!

<?php
ini_set('display_errors', 1); error_reporting(E_ALL);


require_once ('dbconn.php');


$uname = $_POST['uname'];
$pass  = $_POST['pass'];

$userSql   = "SELECT * FROM staff WHERE uname=:uname";
$getUser = $conn->prepare($userSql);
$getUser->execute(array(
    ':uname' => $uname
));


if($getUser->rowCount()){    
    $pwSql = "SELECT pass FROM staff WHERE uname =:uname";
    $getPw = $conn->prepare($pwSql);
    $getPw->execute(array(
        ':uname' => $uname
    ));
    $pw = implode($getPw->fetch(PDO::FETCH_ASSOC));

    if(password_verify($pass,$pw)){
        header("Location: ../../staffHome.php");
    }else{
        echo "Oops! You have entered in an incorrect password!";
    }

}else{
    echo "Oops! That user doesn't exist!";
}
?>

Answer 1

Here's the scoop.

Your conditional statement if(isset($_POST['login'])){...} will never happen, since forms do not hold the name attribute (unless you were using JS/jQuery). You need to name your submit that. <input name="submit" id="submit" type="submit" value="submit">, as PHP does not rely on "id", it relies on a "name" attribute (or again, if you were using JS/jQuery, but that isn't the case here). Then remove name="login" from <form>.

Then you're not passing the connection to your escape function.

Then you're mixing mysql_ functions that to not intermix with anything other than that, mysql_.

We also don't know which MySQL API you're using to connect with.

So, use the same one from connecting to querying, Use either mysqli_ or PDO and preferably using a prepared statement.

Edit: comment from the OP: "I am using PDO to connect."

• You must use the same one from connecting to querying. You can't mix mysql_ or mysqli_ with PDO.

Consult:

• Can I mix MySQL APIs in PHP?
• http://php.net/manual/en/mysqli.real-escape-string.php
• http://php.net/manual/en/mysqli-result.num-rows.php
• http://php.net/manual/en/mysqli.error.php

• http://php.net/manual/en/function.mysqli-connect.php

• PDO error handling http://php.net/manual/en/pdo.error-handling.php

Add error reporting to the top of your file(s) which will help find errors.

<?php 
error_reporting(E_ALL);
ini_set('display_errors', 1);

// rest of your code

Sidenote: Displaying errors should only be done in staging, and never production.

---

Passwords

I also noticed that you may be storing passwords in plain text. This is not recommended.

Use one of the following:

• CRYPT_BLOWFISH
• crypt()
• bcrypt()
• scrypt()
• On OPENWALL
• PBKDF2
• PBKDF2 on PHP.net
• PHP 5.5's password_hash() function.
• Compatibility pack (if PHP < 5.5) https://github.com/ircmaxell/password_compat/

Other links:

• PBKDF2 For PHP

---

Your present code is open to SQL injection. Use mysqli_* with prepared statements, or PDO with prepared statements.