0

I am new to php I have a problem with code - I want to make one more condition in IF to login as an admin - $login="Admin" so I write if($ilu_userow>0 && $login="Admin") instead of if($ilu_userow>0) and it does not work - it doesn't see that condition and if the login is user it is logging too.

<?php

session_start();

if ((!isset($_POST['login'])) || (!isset($_POST['haslo'])))
{
    header('Location: index.php');
    exit();
}

require_once "connect.php";

$polaczenie = @new mysqli($host, $db_user, $db_password, $db_name);

if ($polaczenie->connect_errno!=0)
{
    echo "Error: ".$polaczenie->connect_errno;
}
else
{
    $login = $_POST['login'];
    $haslo = $_POST['haslo'];
    $login = htmlentities($login, ENT_QUOTES, "UTF-8");
    $haslo = htmlentities($haslo, ENT_QUOTES, "UTF-8");

    if ($rezultat = @$polaczenie->query(
    sprintf("SELECT * FROM uzytkownicy WHERE user='%s' AND pass='%s'",
    mysqli_real_escape_string($polaczenie,$login),
    mysqli_real_escape_string($polaczenie,$haslo))))
    {
        $ilu_userow = $rezultat->num_rows;



       if($ilu_userow>0)


   {


            $_SESSION['zalogowany'] = true;

            $wiersz = $rezultat->fetch_assoc();

            $_SESSION['id'] = $wiersz['id'];
            $_SESSION['user'] = $wiersz['user'];
            $_SESSION['drewno'] = $wiersz['drewno'];
            $_SESSION['kamien'] = $wiersz['kamien'];
            $_SESSION['zboze'] = $wiersz['zboze'];
            $_SESSION['email'] = $wiersz['email'];
            $_SESSION['dnipremium'] = $wiersz['dnipremium'];

            unset($_SESSION['blad']);
            $rezultat->free_result();

                header('Location: gra.php'); }


         else {


            $_SESSION['blad'] = '<span style="color:red">Nieprawidłowy login lub hasło!</span>';
            header('Location: index.php'); }
            }
    }

            default;




    $polaczenie->close();
}

?>

Marcin Frankowski
  • 29
  • 1
  • 3
  • *`so I write if($ilu_userow>0 && $login="Admin")`* - well that isn't in your code and it failed you on the latter. **Would you like to know why?** – Funk Forty Niner Nov 16 '17 at 18:57
  • Don't rely on `mysqli_real_escape_string()` to prevent SQL injection, [it alone is not sufficient](https://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string). You should use prepared statements with bound parameters, via either the [**mysqli**](https://secure.php.net/manual/en/mysqli.prepare.php) or [**PDO**](https://secure.php.net/manual/en/pdo.prepared-statements.php) drivers. [**This post**](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) has some good examples. – Alex Howansky Nov 16 '17 at 18:57
  • **Never** store plain text passwords. Instead use [`password_hash()`](http://us3.php.net/manual/en/function.password-hash.php) and [`password_verify()`](http://us3.php.net/manual/en/function.password-verify.php). If you're using a version of PHP prior to 5.5, do **not** use MD5 or SHA1 to hash passwords. Instead you can use [this compatibility pack](https://github.com/ircmaxell/password_compat). – Alex Howansky Nov 16 '17 at 18:58
  • seriously; this isn't a live site, right? I see so many of these. – Funk Forty Niner Nov 16 '17 at 18:58
  • its just a practice...I am going to use password_hash later, I want to login as admin on a different site which requires user_rang=admin or requires login=admin – Marcin Frankowski Nov 16 '17 at 19:00
  • @AlexHowansky about `mysqli_real_escape_string()`, the link you used is `mysql_`, am not sure if this applies on the mysqli_ api. – Funk Forty Niner Nov 16 '17 at 19:01
  • @Fred-ii- yes id love to – Marcin Frankowski Nov 16 '17 at 19:01
  • Great, well this `&& $login="Admin"` is an assignment, you're looking for a comparison `&& $login=="Admin"` with 2x equal signs. @MarcinFrankowski – Funk Forty Niner Nov 16 '17 at 19:01
  • @Fred-ii- Oops, noted, will investigate. – Alex Howansky Nov 16 '17 at 19:02
  • What is `default` doing in there? It's not a **switch** statement. – Karl Hill Nov 16 '17 at 19:04
  • plus, you need to remember that `Admin` and `admin` are different. – Funk Forty Niner Nov 16 '17 at 19:04
  • @Fred-ii- Oh yeah now I remember, I looked at this before. It's still applicable (for example) in the case where you do something like `WHERE FOO = $foo` and you expect that it's a integer so you write the query without quotes. I'll update the wording in my blurb to be more clear, thanks. – Alex Howansky Nov 16 '17 at 19:04
  • @AlexHowansky *Hm...*, interesting. Well, I always use a prepared statement but it's good to know that, thanks. – Funk Forty Niner Nov 16 '17 at 19:05
  • @MarcinFrankowski so, did what I say solve the question? just wondering. I'm no rep "XXX" lol just curious. – Funk Forty Niner Nov 16 '17 at 19:05
  • Yes, it works. Thanks a lot. I don't know how to give rep :D maybe I ll make another topic :D @Fred-ii- – Marcin Frankowski Nov 16 '17 at 19:16

0 Answers0