how to auto login after submitting sign up form in php? - mysqli

i am using php mysqli coding,i create sign up form and login form both are working separately but now i want to provide login after sign up successfully.
this is my sign up code:
{
# insert data into mysql database
$sql = "INSERT INTO `users` (`id`, `username`, `password`, `phone`, `email`)
VALUES (NULL, '{$name}', '{$password}', '{$phone}', '{$email}')";
$query="SELECT * FROM users WHERE email= '$email'";
if ($mysqli->query($sql)) {
$reslt=$mysqli->query($query);
$usr=$reslt->fetch_array();
$_SESSION[user_email]=$usr['email'];
redirect_to("profile.php?email={$_SESSION['user_email']}");
} else {
echo "<p>MySQL error no {$mysqli->errno} : {$mysqli->error}</p>";
exit();
}
}
I tried this way but insertion operation is doing properly but page is refreshing and not redirecting to "profile.php" which is i mentioned in code

first of all, I would suggest that for for a login you check both email and password. Your query should look like:
$query="SELECT * FROM users WHERE email= '$email' and password = '$password'";
Next, if ($mysqli->query($sql)) { just verifies if the sql operation has succeeded. If the user and password are wrong, the sql will succeed but you will have no rows returned.
What you have to do is to verify that you have only 1 row returned by the query. In fact your code should more look like:
...
// check how many users correspond to the query
// ! the result will be an arry
$users = $reslt->fetch_array();
// if I have only one user, login is successfull
if(count($users) === 1) {
$_SESSION['user_email'] = $users[0]['email'];
} else {
// login failed
}
...

Related

How to compare two passwords in codeigniter using encryption

I stored a password in database using an encryption key, but now, when the user wants to login in the system, how can I compare both passwords? Each time it gives a different encrypted password..
$first_password = $this->input->post('password');
$password=$this->encrypt->encode($first_password);
Here is my model code
public function validate_login($username,$password){
$q = $this->db->where(['username'=>$username,'password'=>$password])
->get('oss_user');
if($q->num_rows()){
return $q->row()->user_id;
}
else{
return FALSE;
}
My question is: how can I compare the user entered password with the password stored in database?
You can not compare encrypted password this way. First you have get record from database using email id, once you find row of same email id then you have to pass encrypted password which is store in database on this function "$this->encrypt->decode($encrypted_password);", so you get back original password from encryption form and then compare it with password given during login session, please see follow code.
public function validate_login($username,$password){
$q = $this->db->where(['username'=>$username])
->get('oss_user');
if($q->num_rows()){
$desc_password = $this->encrypt->decode($q->row()->password);
if($desc_password == $password){
return $q->row()->user_id;
}
else
return FALSE;
}
else{
return FALSE;
}

How to check if email exists with MYSQLi

I'm 11 and I'm making a chat site for me and my friends. I'm using MYSQLi to handle the database things, and I'm kinda new to it. I always used normal mysql.
Oh! And if you can share a link to a mysqli tutorial, it would be great :)
Well here's my config file
<?PHP
define("HOST", "localhost"); define("USER", "root"); define("PASSWORD", "****"); define("DATABASE", "secure_login");
$mysqli = new mysqli(HOST, USER, PASSWORD, DATABASE);
?>
The database is secure_login, then I have a table called members, and then a column named email in that table.
I included this to a file (register.php) where I have to check if the email exists or not. And if it exists, redirect to home.
If you guys can help me it would be cool!!! I hope to finish this soon :)
I'd start with reading the MySQLi documentation at http://php.net/manual/en/book.mysqli.php, in specific the methods related to the class. If you are in need of a tutorial I would suggest to search on Google, there are loads of tutorials on the web.
As for your question, something like this should work:
$query = "SELECT email FROM members WHERE USER = ? AND PASS = ?";
if ($stmt = $mysqli->prepare($query)){
// Bind the parameters, these are the ?'s in the query.
$stmt->bind_param("ss", $username, sha1($password));
// Execute the statement
if($stmt->execute()){
// get the results from the executed query
$stmt->store_result();
$email_res= "";
// This stores the value of the emailaddres inside $email_res
$stmt->bind_result($email_res);
$stmt->fetch();
// There is a result
if ($stmt->num_rows == 1){
// Validate the emailadres here, check the PHP function filter_var()
}
else {
// Not a valid email
}
}
else {
printf("Execute error: %s", $stmt->error);
}
}
else {
printf("Prepared Statement Error: %s\n", $mysqli->error);
}
}
I hope this helps

silverstripe external authentification

there is a custom login form that should give users access to certain contents on the same page. That works so far with Users stored as Members in the SS database and I was checking after Login if the user has permissions like this in the Page Class:
function isAllowed() {
if (Member::currentUser()) {
$PresseGroup = DataObject::get_one('Group', "Code = 'presse'");
$AdminGroup = DataObject::get_one('Group', "Code = 'administrators'");
if (Member::currentUser()->inGroup($PresseGroup->ID) || Member::currentUser()->inGroup($AdminGroup->ID)) {
return true;
}
}
}
in the Template I just did this:
<% if isAllowed %>
SecretContent
<% end_if %>
OK so far, but now the users will not be stored in the silverstripe database - they are stored on a another server.
On that external server is running a little php script accepting the username and password. The script just returns user has permission: true or false.
I´m calling that script via cURL.
I planned to overwrite the dologin Function of MemberLoginForm. Now I just wonder how to check after Login that the User got the permission and display the contents... I tried to set a variable in the controller of the Page or should I set a session Variable? Thats my attempt (CustomLoginForm extends MemberLoginForm):
public function dologin($data) {
if(userHasPermission("user1", "pw")==true){
$this->controller->Test("test");
}
$link = $this->controller->Link();
$this->performLogin($data);
$this->controller->redirect($link);
}
I hope someone can help me with that - I know very specific - problem.
Many thanx,
Florian
In SilverStripe you can create a custom authenticator, which means users can log in on your website with accounts that are stored somewhere else, or even just a hard coded user and password.
You can check out the OpenID Authentication Module for example code on how to do it
But for your task this might even be to complex of a solution, how about after login just do something like Session::set('isAllowed', true); and to check if the user is allowed to view:
function isAllowed() {
if (Member::currentUser()) {
$PresseGroup = DataObject::get_one('Group', "Code = 'presse'");
$AdminGroup = DataObject::get_one('Group', "Code = 'administrators'");
if (Member::currentUser()->inGroup($PresseGroup->ID) || Member::currentUser()->inGroup($AdminGroup->ID)) {
return true;
}
}
// if Member::currentUser() is not allowed to view,
// return the session, which is either set to true or it returns null if not set
return Session::get('isAllowed');
}

Facebook PHP-SDK + jQuery AJAX

Im creating a Facebook app using PHP-SDK.
In order to find a user's uid I do:
index.php file
$user_id = $facebook->getUser();
if($user_id == 0) // not logged in user
{
// do stuff to log in user and get the current user id
}
Inside index.php file I have the following jQuery code:
var get_url =
'do_stuff.php?id=' + <?php echo $user_id; ?> + '&field1=' + field1 + '&field2='+ field2;
$.get(get_url, function(data) {
alert("data: " + data);
});
do_stuff.php inserts data on my MySQL database based on field1 and field2. I want to be sure that the data inserted are really from user with $user_id. And not just somebody who did a fake request like:
http://myapp.com/do_stuff.php?id=fake_user_id&field1=...&field2=...
So, I added the $user_id = $facebook->getUser(); at do_stuff.php but instead of returning the current user id (which is visible at index.php), it returns 0 which means no user is logged in. Why is this?
How I can fix it? So I will be sure that the data inserted on my MySQL database are from a real user and not a fake one?
This is because as far as do_stuff.php is concerned, no one is logged in. You probably need to look at capturing the access token and using that in do_stuff.php.

Joomla JUser getinstance Questions

I am attempting to make an authentication plugin. JUser::getInstance() takes one input, and it is supposed to be the id. Is there any way to get an instance of a User using some other indentifier? such as username, email etc.
Probably there isnt any such method. But yes if you are sure that username or email are unique then you can modify your file user.php in libraries/joomla/user/ and add a method there.
getInstanceByEmail($email)
{
$query = "select id from jos_users where email=".email;
// use the code to get the id;
return getInstance($id);
} // this is just a sample code of how it can be achieved
Since Joomla's own authentication is done by checking the user's username (and password of course), it has to be unique. And yes you can do something like what #Rixius suggested.
Here's my version:
// Get a database object
$db = JFactory::getDbo();
$query = $db->getQuery(true);
$query->select('id, password');
$query->from('#__users');
$query->where('username=' . $db->Quote($credentials['username']));
$db->setQuery($query);
$result = $db->loadObject();
$user = JFactory::getUser();
if ($result)
{
$user = JUser::getInstance($result->id);
}