Login to get username not email

Question

I've been struggling to get the username after login using email. I can managed to get the the name of email but not username after logged in.

Look at the code for login.php below:

<form id="myForm" action="loginAction" name="login" method="POST">  
            <p> <label class="inputField" > Email Address : </label> </p>
            <p> <input class="registerField" id="emailid" name="email" required="required" type="text" placeholder="eg. john.wick@yahoo.com"/> <span class="warning" id="emailWarning"> </p>

            <p> <label class="inputField" > Password : </label> </p>
            <p> <input class="registerField" id="password" name="password" required="required" type="password" placeholder="Your password"/> </p>

            <p> <input name="submit" class="registerButton" type="submit" value="LOGIN"> </p>
        </form>

The action will go to loginAction.php

if(isset($_POST['submit'])) {
    $username = trim($_POST['email']);
    $password = trim($_POST['password']);

    $username = $mysqli->real_escape_string($username);
    $password = $mysqli->real_escape_string($password);

    $salt = sha1(md5($password));
    $epwd = md5($password.$salt);

    $loginUser = "  SELECT registerPassword, emailAddress, firstName, lastName FROM register_user
                    WHERE emailAddress = '$username' AND registerPassword = '$epwd'";

    $loginSuccess = mysqli_query($mysqli, $loginUser) or die(mysqli_error($mysqli));
    $loginRow = mysqli_num_rows($loginSuccess);

    if($loginRow === 1) {

        session_start();
        $_SESSION['login'] = true;
        $_SESSION['username'] = $username;

        if ($_SESSION['login'] != '' || $_SESSION['login'] > 0 )

        echo $_SESSION['username'];
        echo $_SESSION['firstName'];
        echo $_SESSION['lastName'];

        header ("Location: index");
        } else {
            header ("Location: loginRegError");
        }
    mysqli_close($mysqli);
}

And when it succeed login, it will go to this page below

<?php
                ini_set('display_errors',1); 
                error_reporting(E_ALL);
                include 'dbconnect.php';

                if(isset($_SESSION['login']) && !empty($_SESSION['login'] )) {
                    $firstName = $_SESSION['firstName'];

                    echo "<p> <a href=\"profileUser\"> $firstName </a>";
                    echo "<img src=\"images/logo/account.png\" /> </p>";
                        } else {
                        echo "<a href=\"loginReg\"> Login/Register </a>";
                        echo "<img src=\"images/logo/account.png\" /> </p>";
                    }
            ?>

The error shows Notice: Undefined index: firstName . If i use $_SESSION for email, it worked, but i want to show first name of user. Any idea?

Answer 1

In your loginAction.php , $_SESSION['firstName'] is not assigned. Thats why later on after redirection, its not set so trying to access it would give the undefined index error.

It might be better to just save the user info row instead if you want to later access it:

$loginSuccess = mysqli_query($mysqli, $loginUser) or die(mysqli_error($mysqli));
$loginRow = mysqli_num_rows($loginSuccess);

if($loginRow === 1) {

    session_start();
    $_SESSION['login'] = true;
    // fetch the values
    $user_info = $loginSuccess->fetch_assoc();
    $_SESSION['user_info'] = $user_info; // assign that row in the session for later use

Then after on that redirection page:

if(isset($_SESSION['login'])) {

    echo $_SESSION['user_info']['firstName'];
    // and others

}

Sidenote: Also its much better to use prepared statements on this case, and use password hashing of PHP 5.5 instead of md5. There is also a compatibility pack for lesser versions (PHP <= 5.4)

Answer 2

session_start();
    $_SESSION['login'] = true;
    $_SESSION['username'] = $username;

    if ($_SESSION['login'] != '' || $_SESSION['login'] > 0 )

    echo $_SESSION['username'];
    echo $_SESSION['firstName'];
    echo $_SESSION['lastName'];

you try to Output $_SESSION['firstName'] but $_SESSION['firstName'] Does not exist.

you set $_SESSION['username']=$username (i think $username was the email only) but you dont set $_SESSION['firstName']

fetch you loginrow and set $_SESSION['firstName']=$fetchedRow['firstName'];

Answer 3

What you're storing in the session variable is $username which equals the input the user sent to you. You're defining only $_SESSION['username'], leaving firstName and lastName undefined. If I understand what you want to do correctly, you'll have to fetch the result from your database query and store it on those variables.