我的简单 PHP 登录脚本没有按预期工作，我不知道为什么

Question

so i'm trying to write a script that fetches info from MYSQL and then compares the username and password entered by the user and if they match just prints "login successful" and then "welcome back "username"".

i have to use some kind of a loop to make sure that all rows are retrieved from the table, however this also causes my script to work improperly, when i enter the user and pass from the first row, it works as intended but when i enter the second user(i have only registered two users in mysql), i get "login failed" message first then "login successful" then welcome back. it seems to me the script checks the first fetched array, then the second one. the problem is that i can not think of another way to write the same script. could u guys help me?

tried the same query without a loop, i only get the first row.

<form method="post">
<input type="text" name="Username" placeholder="Username" ></input>
<input type="text" name="Password" placeholder="Password"></input>
<input type="submit" value="Login">
</form>


<?php
$login = false;
if ($_POST['Username'] && $_POST['Password'] !== "")
{
    $link = mysqli_connect("localhost" , "root" , "test" , "mahmood");
    if ($link == true)
    {
        $query = "SELECT * FROM `users`";
        $row = mysqli_query($link , $query);
        while(  $result = mysqli_fetch_array($row))
        {
            if ($result['username'] == $_POST['Username'] && $result['password'] == $_POST['Password'])
            {
                echo " login successful! "."<br>";
                $login = true;
                echo " Welcome back ".""."$_POST[Username]! ";
                die;
            } else {
                echo " wrong username or password! "."<br>";

            }
        }
        }

       else{
        echo "\n"."failed to connect to the database!"."\n";
    }

} else{echo "\n"."both username and password are required!"."\n";}

expect "login successful" and "Welcome back message" when i enter the user and pass, instead i get "login failed" then "login successful" then "welcome back"

Answer 1

You are looping the result and on each iteration, if the login/password doesn't match, you display an error message, that's why you are getting X number of login failed before seeing success.

In the success part, you used a boolean variable that is set to true. Use it !

while(  $result = mysqli_fetch_array($row))
{
    if ($result['username'] == $_POST['Username'] && $result['password'] == $_POST['Password'])
    {
        echo " login successful! "."<br>";
        $login = true; // <--------------- use this !
        echo " Welcome back ".""."$_POST[Username]! ";
        die;
    }
}
if (!$login)
{
    echo " wrong username or password! "."<br>";
}

---

This will fix your current code, however, you shouldn't loop over the whole list of users.

What if you have 1 billion users. You will do 1 billion of iteration before realizing login/password is wrong.

Plus, this is consuming a lot of bandwith (and unnecessary power, think green .) to fetch all informations from the users table.

You'd rather use a WHERE clause to filter the results. I suppose the username are unique. Using a WHERE clause on the username will fetch 0 or 1 result which will greatly improve performance.

// Prepare the query, bind the parameters and execute it
$query = "SELECT password FROM `users` WHERE username = ?";
$stmt = mysqli_prepare($link , $query);
mysqli_stmt_bind_param($stmt, "s", $_POST['Username']);
mysqli_stmt_bind_result($stmt, $password);
// There will be only 1 loop since username should be unique
while (mysqli_stmt_fetch($stmt))
{
    if ($_POST['Password'] == $password)
    {
        $login = true;
        // success
    }
}
mysqli_stmt_close($stmt);

if (!$login)
{
    // failure
}

For more informations about prepared queries, read the official documentation

---

$result['password'] == $_POST['Password'] this piece of code shows that your passwords are stored in plain text. This is a very bad practice !

Passwords should be hashed.

When registering a user in DB, the password could be hashed using password_hash() :

$hashedPasswoed = password_hash($PlainTextPassword, PASSWORD_DEFAULT);

When a user log in, to compare the passwords, you use password_verify() :

// $password being the hashed password stored in database
if (password_verify($_POST['password'], $password))
{
    $login = true;
    // success
}