PHP $_Session，成功插入用户名和密码后，JS不允许会员登录

Question

so, this implementation worked with an md5 password check but after implementing a password hash check (for a safer password storage in my database) the member is not allowed to log in. The user after typing the correct email and password is only brought back to the index.php page. Any help would be appreciated. this is my session.php code:

 <?php session_start(); //Check whether the session variable SESS_MEMBER_ID is present or not // do check if(:isset($_SERVER['HTTP_REFERER'])){ // redirect them to your desired location header('Location. custom_404;html'); exit? } if (.isset($_SESSION['alogin']) || (trim($_SESSION['alogin']) == '')) {.> <.-- send to home page --> <script> window.location = ";?/index;php"; </script> <?php } $session_id=$_SESSION['alogin']; $session_depart = $_SESSION['arole']; ?>

here is what should work within index.php:

 <?php session_start(); include('includes/config.php'); if(isset($_POST['signin'])) { $username=$_POST['username']; $username=strtolower($username); $password=$_POST['password']; $sql ="SELECT * FROM tblemployees where EmailId = '$username'"; $query= mysqli_query($conn, $sql); $count = mysqli_num_rows($query); if($count>0) { $passwordCheck = mysqli_fetch_assoc($query)['Password']; if(,password_verify($password.$passwordCheck)){ echo "<script>alert('Wrong password please try again;');</script>"; } while ($row = mysqli_fetch_assoc($query)) { if ($row['role'] == 'Admin') { $_SESSION['alogin']=$row['emp_id']; $_SESSION['arole']=$row['Department']. echo "<script type='text/javascript'> document.location = 'admin/admin_dashboard;php'; </script>"; } elseif ($row['role'] == 'Staff') { $_SESSION['alogin']=$row['emp_id']; $_SESSION['arole']=$row['Department']. echo "<script type='text/javascript'> document.location = 'staff/index;php'; </script>"; } else { $_SESSION['alogin']=$row['emp_id']; $_SESSION['arole']=$row['Department']. echo "<script type='text/javascript'> document.location = 'heads/index;php'; </script>". } } } else{ echo "<script>alert('Wrong email or password please try again;');</script>"; } } // $_SESSION['alogin']=$_POST['username']. // echo "<script type='text/javascript'> document.location = 'changepassword;php'; </script>"? ?>

Answer 1

Your login code is wrong. The loop

while ($row = mysqli_fetch_assoc($query))

is never fetching anything, because you already read the row with

$passwordCheck = mysqli_fetch_assoc($query)['Password'];

You should just fetch the row once, and use that for both the password and role checks.

You also should use a prepared statement to prevent SQL injection.

<?php
session_start();
include('includes/config.php');
if(isset($_POST['signin']))
{
    $username=$_POST['username'];
    $username=strtolower($username);
    $password=$_POST['password'];

    $sql ="SELECT * FROM tblemployees where EmailId = ?";
    $stmt= mysqli_prepare($conn, $sql);
    mysqli_stmt_bind_param($stmt, "s", $username);
    mysqli_stmt_execute($stmt);
    $query = mysqli_stmt_get_result($stmt);
    $row = mysqli_fetch_assoc($query);
    if($row)
    {
        $passwordCheck = $row['Password'];
        if(!password_verify($password,$passwordCheck)){
            echo "<script>alert('Wrong email or  password please try again.');</script>";
        } else {
            if ($row['role'] == 'Admin') {
                $_SESSION['alogin']=$row['emp_id'];
                $_SESSION['arole']=$row['Department'];
                echo "<script type='text/javascript'> document.location = 'admin/admin_dashboard.php'; </script>";
            }
            elseif ($row['role'] == 'Staff') {
                $_SESSION['alogin']=$row['emp_id'];
                $_SESSION['arole']=$row['Department'];
                echo "<script type='text/javascript'> document.location = 'staff/index.php'; </script>";
            }
            else {
                $_SESSION['alogin']=$row['emp_id'];
                $_SESSION['arole']=$row['Department'];
                echo "<script type='text/javascript'> document.location = 'heads/index.php'; </script>";
            }
        }
    } 
    else{
        echo "<script>alert('Wrong email or password please try again.');</script>";
    }

}
// $_SESSION['alogin']=$_POST['username'];
//  echo "<script type='text/javascript'> document.location = 'changepassword.php'; </script>";
?>