0

When I try to log in it gives me this error.

Call to undefined function mysql_real_escape_string()

Here is the code for the file:

<?php

  //get values form login.php
  $username = $_POST['user'];
  $password = $_POST['pass'];

  //prevent MSQL injections
  $username = stripcslashes($username);
  $password = stripcslashes($password);
  $username = mysql_real_escape_string($username);
  $password = mysql_real_escape_string($password);


  //connect to server and select database
  mysql_connect("localhost", "root", "");
  mysql_select_db("loginregister");

  //query the database for the user
  $result = mysql_query("select * from users where username = '$username' and password = '$password'") or die("faield to query database ".mysql_error());
  $row = mysql_fetch_array($result);

  if ($row['username'] == $username && $row['password'] == $password) {
    echo "You logged in successfully! Welcome ".$row['username'];
  } else {
    echo "Login Failed";
  }
?>

The expected result is after I log in it says you logged in successfully. How do I fix this?

marc_s
  • 732,580
  • 175
  • 1,330
  • 1,459
Sean Blumenfeld
  • 1
  • 2
  • 1
    Use MySQLi or PDO with a prepared statement instead, that will fix your issue. – Qirel May 18 '19 at 15:41
  • Also, UNHASHED passwords are ***not secure at all***! – Qirel May 18 '19 at 15:41
  • how do I do that? – Sean Blumenfeld May 18 '19 at 15:41
  • and How do I hash the password? – Sean Blumenfeld May 18 '19 at 15:42
  • https://php.net/mysqli-prepare or https://php.net/pdo-prepare - you cannot use `mysql_` - its outdated and not supported in newer versions of PHP. – Qirel May 18 '19 at 15:42
  • 1
    See https://php.net/password_hash for hashing passwords – Qirel May 18 '19 at 15:43
  • Also `$row['username'] == $username && $row['password'] == $password` is prone the [timing attacks](https://en.wikipedia.org/wiki/Timing_attack) the safe method is [hash_equals](https://www.php.net/manual/en/function.hash-equals.php) – Raymond Nijland May 18 '19 at 17:28
  • ... but for password_hash() which @Qirel is suggesting you should use [password_verify](https://www.php.net/manual/en/function.password-verify.php) to prevent timing attacks. – Raymond Nijland May 18 '19 at 17:29
  • Basically `select * from users where username = '$username' and password = '$password'` can be totally prone to timing attacks also especially when the username and password are both in the btree index.. ive once did research/tests on a local MySQL server it seamt totally possible to do a timing attack when selecting data as databases are designed to return data as soon as possible... Ideally you should **only** use the `WHERE` on username and compare the password with a safe hash compare.. – Raymond Nijland May 18 '19 at 17:34

0 Answers0