无法使用正确的用户名和密码 php 和 myql 登录

Question

Hello every one i'm new to php. I was just trying to create a multi users login system. In the first approach i get what is required but whenever i try to login with wrong username or password. else statement echos multiple times. but in the second approach i get the last statement executed every time i try to login even with correct username and password.

This is the first approach

    if(isset($_POST['signin'])){
        $username = $_POST['username'];
        $password = $_POST['password'];
        $query = "SELECT * from `users`;";
        if(count(fetchAll($query))>0){
            foreach(fetchAll($query) as $row){
              if($username==$row["username"]&&$password==$row["password"]&&$row["type"]=="admin"){
                  echo  "Admin";
              }elseif($username==$row["username"]&&$password==$row["password"]&&$row["type"]=="teacher"){
                echo "Teacher";
            }elseif($username==$row["username"]&&$password==$row["password"]&&$row["type"]=="student"){
                echo  "Student";
             }else{
                  echo "Username or password not found!";
              }
            }
        }else{
            echo "<script>alert('Unknown Error')</script>";

        }
    }

and this is second one

if(isset($_POST['signin'])){
            $username = $_POST['username'];
            $password = $_POST['password'];
            $admin_query = "SELECT * from `users` where username = '$username' and password = '$password' and type = 'admin';";
            $teacher_query = "SELECT * from `users` where username = '$username' and password = '$password' and type = 'teacher';";
            $student_query = "SELECT * from `users` where username = '$username' and password = '$password' and type = 'student';";
            if(performQuery($admin_query==1)){
                echo "Admin";

            }elseif(performQuery($teacher_query==1)){
                echo "Teacher";

            }elseif(performQuery($student_query==1)){
                echo "Student";

            }else{
                echo "No user found ";
            }
}

The performQuery function is

function performQuery($query){
    $con = new PDO(DBINFO,DBUSER,DBPASS);
    $stmt = $con->prepare($query);
    if($stmt->execute()){
        return true;
    }else{
        return false;
    }
}

Answer 1

<?php
            $con = mysqli_connect('');// taking as your connection query

            $username = "whatever";//taking as user input
            $password = "Password";//taking as user input

            //By using direct data in SQL login query you are subject to SQL injection. Please Make sure to use prepared statements.

            $admin_query = "SELECT * from `users` where username = '$username' and password = '$password' and type = 'admin';";
            $teacher_query = "SELECT * from `users` where username = '$username' and password = '$password' and type = 'teacher';";
            $student_query = "SELECT * from `users` where username = '$username' and password = '$password' and type = 'student';";

            // by using oop approch
            if($con->query($admin_query)){
                echo "Admin";

            }elseif($con->query($teacher_query)){
                echo "Teacher";

            }elseif($con->query($student_query)){
                echo "Student";

            }else{
                echo "No user found ";
            }

            // by using procedural  approch
            if(mysqli_query($con,$admin_query)){
                echo "Admin";

            }elseif(mysqli_query($con,$teacher_query)){
                echo "Teacher";

            }elseif(mysqli_query($con,$student_query)){
                echo "Student";

            }else{
                echo "No user found ";
            }
?>

Note: Use a prepared statement to avoid SQL injection

Answer 2

First, when you are using database query try to bind the parameters instead of concatenation to your query because it will lead to SQL Injection

Now as your code state that your are passing boolean to your performQuery function instead of query

performQuery($admin_query==1) will lead to performQuery(false) as $admin_query is not equal to 1. That's why your query is failing.

If you print the $query in your function you will find it out.

So, you have to remove that check inside the param. The code will be like this

        if(performQuery($admin_query)){
            echo "Admin";

        }elseif(performQuery($teacher_query)){
            echo "Teacher";

        }elseif(performQuery($student_query)){
            echo "Student";

        }else{
            echo "No user found ";
        }


        function performQuery($query){
            try {    
                $con = new PDO(DBINFO,DBUSER,DBPASS);
                $stmt = $con->prepare($query);
                if($stmt->execute()){
                    if($stm->fetchColumn()){
                        return true;
                    }
                }else{
                   echo 'Error -> ';
                   var_dump($st->errorInfo());
                   echo '<br/>Query -> ';
                   var_dump($query);
                }
            catch(Exception $e) {
                echo 'Exception -> ';
                var_dump($e->getMessage());
                echo '<br/>Query -> ';
                var_dump($query);
            }
            return false;
        }