php＆MySQL-帐户登录错误

Question

I am thinking about making a sign in form on my website with php and MySQL. I inserted some data in my database, and it's perfectly connected to the php file. But the issue is that everyone can login! even if the account does not exist in the database.

<?php

//connection_start
$mysqli = new mysqli('example','example','example','example');

//check_connection
if($mysqli->connect_error){
    die("Connection error (check_connection): " . $mysqli->connect_errno . " : " . $mysqli->connect_error );
    exit();
}

//Get_user_input
$uName = mysqli_real_escape_string($mysqli, $_POST['form_username']) ;
$uPass = mysqli_real_escape_string($mysqli, $_POST['form_password']) ;

//Verify_existance_in_db
$Q_search_username = mysqli_query($mysqli, "SELECT `username` FROM `users` WHERE `users`.`username` LIKE '$uName' ");

if($Q_search_username){
    $Q_search_passsword = mysqli_query($mysqli, "SELECT `password` FROM `users` WHERE `users`.`password` LIKE '$uPass' "); 
}else{
    echo "You are not registered yet" ;
}

//decide_in_or_not
if($Q_search_passsword){
    echo "You are in" ;
}else{
    echo "Wrong password. Access denied" ;
}

//Connection_end
$mysqli->close();

?>

Is there a way to fix my code? any help will be highly appreciated.

Answer 1

It seems like the problem here is with your query:

You should change this:

`$Q_search_username = mysqli_query($mysqli, "SELECT `username` FROM `users` WHERE `users`.`username` LIKE '$uName' ");`

to this:

`$Q_search_username = mysqli_query($mysqli, "SELECT `username` FROM `users` WHERE `users`.`username` ='$uName' ");`

same with this:

$Q_search_passsword = mysqli_query($mysqli, "SELECT `password` FROM `users` WHERE `users`.`password` LIKE '$uPass'"); 

to this:

$Q_search_passsword = mysqli_query($mysqli, "SELECT `password` FROM `users` WHERE `users`.`password` ='$uPass' "); 

SUGGESTION:

or if you want to make it simplier you could just do your query like this:

$Q_search_passsword = mysqli_query($mysqli, "SELECT * FROM `users` WHERE `users`.`username` ='$uName' and  `users`.`password` ='$uPass' "); 

---Just fuse the query for selecting username and password.