SHA function issues
- by Damian James
I have this php code from my login.php
if (isset($_POST['logIn'])) {
$errmsg = "";
$logname = mysqli_real_escape_string($dbc, trim($_POST['usernameIn']));
$logpassword = mysqli_real_escape_string($dbc, trim($_POST['passwordIn']));
$query = "SELECT user_id, username FROM members WHERE username = '$logname' AND password = SHA('$logpassword')";
$data = mysqli_query($dbc, $query);
if (mysqli_num_rows($data) == 1) {
$row = mysqli_fetch_array($data);
setcookie('user_id', $row['user_id'], time() + (60 * 60 * 24 * 30)); //expires after 30 days
setcookie('username', $row['username'], time() + (60 * 60 * 24 * 30));
$home = 'http://' . $_SERVER['HTTP_HOST'] . dirname($_SERVER['PHP_SELF']) . '/index.php';
header('Location: ' . $home);
}
else {
$errmsg = '<p class="errormsg">Username or password is incorrect.</p>';
}
}
And for some reason, it always ends up setting $errmsg in the else statement. I am sure that I'm entering information (username,password) that is correct and exists in the database.
I insert my values (from a signup script) using this query:
$query = "INSERT INTO members (username, password, email) VALUES ('$username', SHA('$password'), '$email')";
Anyone see the problem with this script? Thanks!
