Codeigniter Login

Question

Ive got a Codeigniter login system here, and just wondering where im going wrong. Heres my code:

View

<?php
echo form_open('handyman/logIn');
echo form_label('Email: ','useremail');
echo form_input('useremail');
echo "<br />";
echo form_label('Password: ','userpassword');
echo form_input('userpassword');
echo "<br />";
echo form_submit('Logmein','Log In');
echo form_close();
?>

Controller

public function logIn(){
      $useremail=$this->input->post('useremail');
      $userpassword=md5($this->input->post('userpassword'));
      $this->load->model("HandymanModel");

      if($useremail && $userpassword && $this->HandymanModel->logInUser($useremail,$userpassword)){
        $data['msg']="Successfully Logged in!";
        $data['title']="Logged In";
        $this->load->view("header",$data);
        $this->load->view("confirmation",$data);
        $this->load->view("footer",$data);
      } else{
        $data['title']="Sign up / Log in";
        $this->load->view("header",$data);
        $this->load->view("page3", $data);
        $this->load->view("footer",$data);
      }
    }

Model

 function logInUser($useremail,$userpassword) { 
    $this->db->where('email',$useremail );
    $this->db->where( 'password', $userpassword );

    $login = $this->db->get()->result();

    if (is_array($login) && count($login) == 1) {
        return true;
    } else {
        return false;
    } 

I'm getting Error Number: 1064 which is check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE email = 'email@gmail.com' AND password = '1a1dc91c9073' at line 2

Thanks

Answer 1

You re missing the table name

$login = $this->db->get( )->result();
                        ^^here

Try this by adding table name

$login = $this->db->get('your table name')->result();

$this->db->get();

Answer 2

I would change your model to something like...

function logInUser($useremail,$userpassword) {

$query = $this->db->query('SELECT * FROM tbl_name WHERE account_email="'.$useremail.'" AND account_password = "'.$userpassword.'"');

if ($query->num_rows() != 0){
    return true;
} else {
    return false;
} 

}

I would also suggest encrypting user passwords as well. take a look at MD5. Make sure you use a hash as well.

Cheers!